what do i need for security?

gsfgf · Veteran Joined: 08 May 2002 Posts: 1266

I have a freebsd bo that's in the DMZ on my network. I use it as a web, ftp, telnet, and ssh server. What do i need to do to secure it? I need telnet in case i need to get into it from a win box that doens't have putty., but i don't use it unless i can't help it.
_________________
Aim:gsfgf0

splooge · l33t Joined: 30 Aug 2002 Posts: 636

Telnet security?

Never heard of it =)

You'd probably be better off asking this type of question on a bsd forum, as from what I can tell bsd doesn't use iptables, which is step #1 in securing the box.

Step #2 is removing telnet.

simulacrum · Posted: Sat Dec 07, 2002 8:16 pm Post subject:

I would concur that you do not want telnet enabled. On my server the only ports I have open are ssh, http, and smtp. Putty doesn't require an installation so you can run it from any machine without having to do anything but download the client. Also, as far as file transfers go, you can use sftp (secure ftp) or scp through ssh. There are putty clients available (psftp).

frogger · n00b Joined: 05 Dec 2002 Posts: 35

First off, as everyone else has said, disable telnet. By telnetting into your box you're basically just giving away all your data in plain text. Security is out the window.

Another question, since FTP is also all plain text, do you REALLY need it? If you're running an anonymous public ftp server, perhaps. If you are using it for just a few user accounts, why not use sftp? Much more secure. I'm not a big fan of giving away passwords in plain text

And yes, I do rant on about plain text passwords, but it is soooo easy for people to sniff unencrypted traffic. If you'd like to see just give dsniff a try. You'll be amazed what you (or anybody in the middle) can see.

Simply enough, just follow the FreeBSD stable branch and keep up with any security advisories announced. Firewall off any unnecessary ports. Don't run telnet/ftp

474 · l33t Joined: 19 Apr 2002 Posts: 714

Don't ever use telnet to access your internal hosts from outside, via the Internet. However, I think it's acceptable to use telnet internally provided your users have low awareness/danger factor (i.e. they're not the kind to run packet sniffers or you have a switching non-promiscuous network hub).

If you are concerned about not always having an SSH client when you need to get at it from outside the office, then you might want to consider doing this (a) get a Java based SSH client applet and (b) host it on an internal web server. You can then visit that web page from the outside and as long as you have a java-enabled browser use the SSH client provided. There is one available, but I can't remember its name - you could try googling for it. Webmin also has a similar feature, and you can use Webmin over SSL (https) so that would be a better solution too (you can even configure a Webmin user so that SSH is the only option you get when you login to it).

gsfgf · Veteran Joined: 08 May 2002 Posts: 1266

i guess the java putty client would work. I had telnet so if i wanted to I rarely use ftp and telnet. IIRC i have only once logged in w/ telnet, i just have it in case i'm at school where i can't dl the a putty client and need to get something off it and apache's croaked. accedd to docs = good. Also i need the box to access the reast of the netowrk. I use it as a ssh server (via ssh over the net) for remote access of the rest of my netowrk. This in mind, i had been just using default settings to secure it and not using telnt when i don't have to. I'm not really worried about ftp insecurity since the ftp user is limited.
_________________
Aim:gsfgf0

gsfgf · Veteran Joined: 08 May 2002 Posts: 1266

i guess the java putty client would work. I had telnet so if i wanted to I rarely use ftp and telnet. IIRC i have only once logged in w/ telnet, i just have it in case i'm at school where i can't dl the a putty client and need to get something off it and apache's croaked. accedd to docs = good. Also i need the box to access the reast of the netowrk. I use it as a ssh server (via ssh over the net) for remote access of the rest of my netowrk. This in mind, i had been just using default settings to secure it and not using telnt when i don't have to. I'm not really worried about ftp insecurity since the ftp user is limited.
_________________
Aim:gsfgf0

#! · n00b Joined: 20 Nov 2002 Posts: 11

Why bother with ftp at all? Using sftp just needs the ssh daemon to be running, so in truth you don't have as many daemons running which can't be a bad thing right? You might as well just have sftp. Then if you're really needing it you can use it, and if you don't have access to an sftp client, you could ssh to your box and start the ftpd. I just don't see the point in leaving yourself vunerable.
_________________
"...you might as well skip the Xmas celebration completely, and instead sit in front of your linux computer playing with the all-new-and-improved linux kernel version."
(By Linus Torvalds)