Re: openssh
Dagmar d'Surreal <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 2002-12-04 at 10:05, Rainer Peter Feller wrote: > Hi, > I have a PC with several (3) ethers and want the users to use a SINGLE > ether for outgoing ssh-conections. > The main problem is that you can easy override the system defaults. > So I patched the stuff. > Now there could be also a /etc/ssh/ssh_conf_p where the system defaults > which can't be changed are decleared. > Would be nice, if someone else could test it too ... > May be it is also useful enough. You realize that while your patch may work, it won't stop them from making connections out. Telnet can go to port 22 just fine, and there's probably nothing stopping your users from building their own copy of ssh, or bringing their own binary. If you _really_ want to stop connections from going out to port 22 on those other interfaces, add some drop rules to your iptables configuration--or better yet _secure the hosts on those segments_. -- Unsubscribe: send email to [email protected] and put 'unsubscribe lfs-security' in the subject header of the message