Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 236 / 861

236 Defining your security environment
Controlling full application inspection of traffic
Related information
None.
Enabling remote logon
The security gateway supports connections from remote hosts to internal resources through the
Telnet protocol. The Telnet protocol is commonly used to connect to a remote host, and execute
commands on that remote host as if the user were physically sitting at the host. Through the Telnet
proxy, the security gateway can insure that all Telnet commands are legitimate and are RFC-
compliant.
How the security gateway handles remote logons
Similar to most of the other proxies, the Telnet proxy performs forward and reverse lookups on the
source IP address of the connection attempt. If the results of the lookups are not consistent, the proxy
suspects DNS contamination and drops the connection.
If the Telnet proxy accepts the lookup information and the connection is non-transparent, the Telnet
proxy prompts the client for the destination host name and (optionally) the destination port. For
transparent connections, the destination is already known. When this information is provided,
gwcontrol:
■
Denies the connection if the destination host name does not exist or is invalid
■
Allows the connection without restrictions
■
Allows the connection with user, group, or authentication restrictions
If the connection is allowed, but with restrictions, and depending on the authentication method, the
Telnet proxy may prompt for a user name and password. If the user name and password are valid, the
Telnet proxy then negotiates with the destination machine and begins proxying packets.
When the Telnet proxy authenticates a user through standard passwords, gwcontrol performs the
authentication. For other forms of authentication, the Telnet proxy makes the call itself.
If no authentication method is specified for the rule, but users or groups are specified, the Telnet proxy
performs multiple authentication, as follows:
■
For connections external to the protected network, and destined for the protected network, the
Telnet proxy tries internal authentication first.
■
If the user has an internal authentication account, but provides an incorrect password, the
connection is refused.
Configuring access for Telnet traffic
Configuring access for Telnet lets users connect directly to resources your security gateway protects.
Prior to configuring access, you should determine what level of access is to be granted, and who should
have that access. Telnet connections can be points of directed attention because the Telnet stream
passes in clear text, often exposing user names and passwords as well as sensitive data. If possible, try
to use SSH instead of Telnet for a more secure connection.
Prerequisites
None.