Re: stopping outgoing services/

[joshua stein <jcs_(_at_)_rt_(_dot_)_fm>]

Matthew McGehrin <matthew_(_at_)_subnetmask_(_dot_)_net> wrote:
> 2. Change the permission's on the various services you wish to 
> deny.
> 
> ie: 
> bluemoon# ls -ald telnet
> -r-xr-xr-x  1 root  bin  110592 May 13 18:15 telnet
> 
> 
> to:
> 
> bluemoon# chmod o-rx telnet 
> bluemoon# ls -ald telnet
> -r-xr-x---  1 root  bin  110592 May 13 18:15 telnet

removing or disabling these binaries is useless.  what's to stop a user
from scp'ing over a telnet binary?  or writing a simple replacement
using the local perl interprater?

the only way to stop outgoing services is to firewall the port (which
doesn't do much to prevent someone from running it on a non-standard
port) or flat out deny them access to your server.  what good is an
account on your server if it cannot communicate with any other systems?

-- 
joshua stein <jcs_(_at_)_rt_(_dot_)_fm>