Re: [Lilux-help] telnet or ssh through coward firewalls

Hi, On Sat, 24 Jul 2004, Jay Christnach wrote: Standard procedure, as long as you're not talking ISP. You block everything by default, except what you absolutely need. This is not "Windows-Sysadmins poor-sports", but normal network security paranoia (where question is never whether you're paranoid, but whether you're paranoid enough!). If something's needed, you get the guy(s) in charge of network security to open that thing up. Good question. I've heard about setups where they authorized telnet, but didn't even know what ssh was... One reason might be that you can tunnel about whatever you like through simple means with ssh, making life more difficult for the network security guy. Normally, I sure wouldn't block ssh (<mode=BOFH>at least originating from my own machine</mode>). You don't want telnetd. Yes, you can run sshd on whatever port you want. IPCop by default runs sshd on port 222 IIRC, for instance. Often, high ports (over 1024) are not blocked, with the possible exception of some well-known ports used by P2P software or trojans. <mode=paranoia>You do know that some viruses spread through certain well-established IRC clients? mirc on Windows is one often-targeted client. For that reason alone, you'll see IRC blocked.</mode> Also, many larger chatservers offer web-interfaces, many users wouldn't even know what IRC is or that there are specific clients other than those web-interfaces. If you want to do some testing, why not listen to traffic on some linux machine you control (using tcpdump for instance), and run an nmap scan from the location you want to connect from? You'd easily see what reaches the server, nmap might tell you whether certain ports are filtered. Greets Eric