Is it possible block certain port ? (HP-UX 11)

[JI HUI]

Sorry for blank message.

Is it possible to block certain traffic based on port? For example, only http traffic is allowed from this machine but no ftp traffic is allowed?

I know it could be done by implementing external firewall?

Is it possible to implement this at HP-UX itself?

[Santosh Nair_1]

As far as I know, there is no way to block an outgoing port from the HP side. The alternative would be to remove the execute permissions for these programs, i.e. ftp, telnet, etc. But most smart users will quickly realize that they can copy the executable from somewhere else and make use of it from their home directory.

-Santosh

[Eugen Cocalea]

Hi,

On Santosh's solution, I can add 'and mount their home directories partition with 'no exec' option' but this is beginning to be BOFH ;)

E.

[Duncan Edmonstone]

Have a look at IPSEC/9000 - its a free product on the application CDs.

Ostensibly its for creating secure connections, and doing VPN tunneling, but if you look at how the rules work, its entirely possible to define rules that just completely block outgoing connections on certain ports...

HTH

Duncan

[Santosh Nair_1]

Actually, I had forgotten that HP also is shipping IPFilter/9000 on the March application CD. Its alpha version of the software, but it should do what you're looking to do. More info in the following links:

http://docs.hp.com/hpux/internet/#IPFilter/9000
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x6cfca12d6d27d5118fef0090279cd0f9,00.html

-Santosh

[Manoj Kumar Sarangi]

Yes,
This is very much possible. Go to /etc/inetd.conf and comment out the ftp line. Get the daemon to re-read the inetd.conf file by isssuing a command

inetd -c

You can do this for other services too.

Other than this if you want to restrict access to a chosen no of hosts you can use TCP Wrappers
ftp://ftp.cerias.purdue.edu/pub/tools/unix/netutils/tcp_wrappers/tcp_wrappers_7.6.tar.gz
the above applies to services started by inetd. For all other services(standalone) you can stop and disable them manualy in the files (most of them) in /sbin/init.d directory.

Hope this helps..

Manoj

[Santosh Nair_1]

Manoj,

As I understand the question, the author is asking how to block outbound connections, i.e. a user telnetting out of the machine to another machine...which is very different from blocking inbound connections, i.e. a user telnetting into the machine.

-Santosh

[harry d brown jr]

You could change the execute permissions on ftp, telnet, etc...

also, consider reading and implementing this:

http://people.hp.se/stevesk/bastion.html

live free or die
harry

[Darrell Allen]

Hi,

If you are trying to block connections initiated from a remote system to your HP server, check into using /var adm/inetd.sec (man inetd.sec) on the HP.

Darrell