OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [OT] Detecting "telnet"?

From: Michael J Wise (mjwisekapu.net)
Date: Fri Jun 11 2010 - 01:03:07 CDT


On Jun 10, 2010, at 9:19 PM, Victor Duchovni wrote:

> On Thu, Jun 10, 2010 at 11:31:49PM +0200, Ralf Hildebrandt wrote:
>
>> I heard that there are firewalls/security appliances that supposedly
>> can distinguish "somebody using telnet" from "a machine speaking SMTP".
>>
>> I must admit, it sounds feasible (timing between keystrokes etc.), but
>> little useful.
>>
>> Anyway. Is there such a thing? Does anybody use such a thing?
>
> Why do you want to discriminate against "telnet 25"? Administrators of
> sites that want to trouble-shoot connectivity issues with your server
> will use "telnet 25" from time to time. There is no need to block
> this, it is by far the least likely source of any significant spam
> volume...

Certainly agree.

If someone IS doing it ... they have a really good reason.
And you would do WELL to make it reasonably easy for them.

I had to do it the other day to figure out what was going wrong with a certain hard to debug subsystem.

Aloha,
Michael.
--
"Please have your Internet License http://kapu.net/~mjwise/
 and Usenet Registration handy..."