Drop telnet to port 25

[Tzvika Faibish_1]

Hi Guys,
Can I drop telnet to port 25? how can I do it?

Thanks,
Tzvika

[Jeff Schussele]

Hi Tzvika,

I think so, BUT you'd have to disable sendmail & remove it's entry from /etc/services & then edit /etc/services to make telnet 25/tcp now.

AND whenever someone telnets they'd have to
telnet hostname 25

Doable, but not practical IMO.

Rgds,
Jeff

[Laurent Menase]

Hi
if you want to telnet to port 25:
telnet destination-ip 25

if it is the server telnetd on port 25
you can define a port in /etc/services
mytelnet 25/tcp
then in /etc/inetd.conf

copy the telnet line and replace the leading telnet by mytelnet.
mytelnet stream tcp nowait root /usr/lbin/telnetd telnetd

then inetd -c

[Sundar_7]

Hi Tzvika,

If you just would like the capability of being able to just send mails outside then recommended practice is to have sendmail run via cron at a defined interval than as a daemon. The sendmail run via cron will ensure that repeated attempts are made for unsuccessful mail deliveries.

This way you can make sure none can telnet to 25.

Or if you would like to restrict telnet access only to nodes from certain network then have inetd kicks off a sendmail and restrict the hosts via /var/adm/inetd.sec

Sundar.

[Tzvika Faibish_1]

Guys,
What I want is to keep my sendmail on BUT drop the telnet to port 25. Any ideas?
Thanks,
Tzvika

[Jim Mallett]

I may be wrong (it wouldn't be the first time), but I don't think it's possible to stop telnet on 25 and have sendmail function properly. I don't think there is a distinction between a telnet connection and a connection from another mail server.

If your concerns are becoming a spam relay, there are settings you can change to keep from mail being relayed from the outside world.

I personally don't use it, so can't vouch for it, but Postfix (www.postfix.org) is a 3rd party alternative.

Jim

[Tim D Fulford]

WHY? port 25 is smnp; port 21 telnet; why do you want fiddle with this well documented, programmed & generaly assumed convention? If you do, you will need to change the way EVERYTHING telnets & smnp's to that machine. I see no reason to do this other than it can be done. What is wrong with port 21?

That said, I'd use a high value port number which is not used (so you don't conflict with anything else) say "telnet 21021/tcp", This port is not registered so you are not likely to be playing "musical port numbers".

my 0.02â ¬ worth, regards