securing telnet for lan use only

rude_reality · 02-03-2007, 03:14 AM

Ok, I been setting up my linux box (slackware 11) to be router/server for my home. I would like to take the monitor and keyboard off of it and have to running in a corner. My plain was to use samba and telnet to transfer files and access it if I need to change or to upgrade the system. I have samba responding to my network address of 192.168.1.0 only. Is there away to have telnet only take connection from my lan and not the internet?

My setup:

2 nic
1 Linsys AP (eth1)
1 DSL Modem (eth0)

acid_kewpie · 02-03-2007, 03:36 AM

uninstall telnet, use ssh instead. both telnet and ssh typically support tcpwrappers though, so you can control what can reach them via /etc/hosts.allow adn /etc/hosts.deny. additionally, you should have a generic firewall sitting infornt of all this anyway.

slzckboy · 02-03-2007, 05:37 AM

As intimated by acid_kewpie you just configure your firewall only to allow connections to port 22(ssh) or port 23 (telnet) from within your lan subnet, and not from your external internet interface.

You should be blocking all incoming connections by default anyway from the net.?!

rude_reality · 02-05-2007, 02:50 AM

Ok, it sounds like the firewall is the key. do you know any good links on firewall scripting?

dx0r515t · 02-05-2007, 11:21 AM

http://www.linuxguruz.com/iptables/howto/
http://iptables-tutorial.frozentux.n...-tutorial.html
Or just google "iptables tutorial".

As a reference to allow ssh use something like this (with default policy DROP):

Code:

iptables -A INPUT -p tcp -s 192.168.1.100 --dport 22 -m state --state NEW -j ACCEPT

slzckboy · 02-05-2007, 11:26 AM

I would also say iptables,but then that is all I have ever used!?!!

If you decide to use it spend some time reading the iptables howto.

Very powerful and very useful firewall.
Make sure you are dropping all incoming connections by default.

Just running the command above will be pointless if you have a fresh default iptables setup which lets everything through anyway.

Goodluck.

rude_reality · 02-09-2007, 06:15 AM

thank you for the help...