<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;"><DIV>Michael,</DIV>
<DIV>What i've got on my side of the fence here in PA is my GATEWAY machine</DIV>
<DIV>is wide open to anyone who want's to telnet in. They can telnet in on the</DIV>
<DIV>44 ip or my comercial ip. Once they telnet in, they can look around, read</DIV>
<DIV>bulls and such. They CAN NOT telnet out, ping or send any mail, EXCEPT</DIV>
<DIV>sending mail to the sysop, ASKING for more perms. AFter I verify them,</DIV>
<DIV>i'll have them send a password they want and set there account up on the</DIV>
<DIV>box. </DIV>
<DIV> </DIV>
<DIV>Here is the stickey part. Once the user is known on the box, has his</DIV>
<DIV>call sign and password loaded into the ftpusers file, they MUST use that</DIV>
<DIV>combo to gain access to the box. If they forget there password, then they</DIV>
<DIV>have to give me a yell for password change or recovery. Mind, they can still</DIV>
<DIV>log in with example, there name or something like that and have limited access.</DIV>
<DIV> </DIV>
<DIV>Now, if someone is sitting on a 44 address, they can log into my RF box </DIV>
<DIV>directly via the netrom. Thing is, they have to have a netrom path to the</DIV>
<DIV>RF box. I'm thinking that if someone else has left them have privs to netrom</DIV>
<DIV>or telnet out of there box, they SHOULD have already been checked out.</DIV>
<DIV>This is where i'm relying on the rest of the 44 community to police there</DIV>
<DIV>equipment as I attempt to do.</DIV>
<DIV> </DIV>
<DIV>Kerry - n3nxo</DIV>
<DIV> </DIV>
<DIV><BR><BR>--- On <B>Wed, 6/1/11, Michael Fox - N6MEF <I><n6mef@mefox.org></I></B> wrote:<BR></DIV>
<BLOCKQUOTE style="BORDER-LEFT: rgb(16,16,255) 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px"><BR>From: Michael Fox - N6MEF <n6mef@mefox.org><BR>Subject: [nos-bbs] JNOS with public telnet<BR>To: "'TAPR xNOS Mailing List'" <nos-bbs@tapr.org><BR>Date: Wednesday, June 1, 2011, 12:49 PM<BR><BR>
<DIV id=yiv323432823>
<STYLE><!--
#yiv323432823
_filtered #yiv323432823 {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered #yiv323432823 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
#yiv323432823
#yiv323432823 p.yiv323432823MsoNormal, #yiv323432823 li.yiv323432823MsoNormal, #yiv323432823 div.yiv323432823MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:11.0pt;font-family:"sans-serif";}
#yiv323432823 a:link, #yiv323432823 span.yiv323432823MsoHyperlink
{color:blue;text-decoration:underline;}
#yiv323432823 a:visited, #yiv323432823 span.yiv323432823MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
#yiv323432823 span.yiv323432823EmailStyle17
{font-family:"sans-serif";color:windowtext;}
#yiv323432823 span.yiv323432823EmailStyle18
{font-family:"sans-serif";color:#1F497D;}
#yiv323432823 .yiv323432823MsoChpDefault
{font-size:10.0pt;}
_filtered #yiv323432823 {margin:1.0in 1.0in 1.0in 1.0in;}
#yiv323432823 div.yiv323432823WordSection1
{}
--></STYLE>
<DIV class=yiv323432823WordSection1>
<P class=yiv323432823MsoNormal>What is the experience out there with allowing public telnet access to JNOS? And, if you do allow it on your machine, what security measures have you taken?</DIV>
<P class=yiv323432823MsoNormal> </DIV>
<P class=yiv323432823MsoNormal>Some background: </DIV>
<P class=yiv323432823MsoNormal>On my Linux machine, I have iptables rules to avoid SYN attacks and rules to avoid more than X number of connections from a given host within Y amount of time. These apply to connections to linux as well as connections forwarded across the tunnel to JNOS. This puts a damper on brute force attacks such as dictionary attacks. </DIV>
<P class=yiv323432823MsoNormal> </DIV>
<P class=yiv323432823MsoNormal>However, linux is also running DenyHosts which is set to disallow (forever) connections from machines that have more than X failed login attempts in a row. This pretty much kills dictionary attacks except if they come from multiple machines. Every day, I record at least one (sometimes two or three) machines that have been added to the denyhosts file. So I know for sure that there is a constant flow of attack.</DIV>
<P class=yiv323432823MsoNormal> </DIV>
<P class=yiv323432823MsoNormal>Since something like DenyHosts is not available at the JNOS level, the iptables rules can slow down, but not completely stop brute force attacks from a given hosts. So, I’m wondering if anyone with public telnet access has any other tricks up their sleeve for helping to secure JNOS.</DIV>
<P class=yiv323432823MsoNormal> </DIV>
<P class=yiv323432823MsoNormal>Thanks,</DIV>
<P class=yiv323432823MsoNormal>Michael</DIV>
<P class=yiv323432823MsoNormal>N6MEF</DIV></DIV></DIV><BR>-----Inline Attachment Follows-----<BR><BR>
<DIV class=plainMail>_______________________________________________<BR>nos-bbs mailing list<BR><A href="http://us.mc1146.mail.yahoo.com/mc/compose?to=nos-bbs@tapr.org" ymailto="mailto:nos-bbs@tapr.org">nos-bbs@tapr.org</A><BR><A href="https://www.tapr.org/cgi-bin/mailman/listinfo/nos-bbs" target=_blank>https://www.tapr.org/cgi-bin/mailman/listinfo/nos-bbs</A><BR></DIV></BLOCKQUOTE></td></tr></table>