IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Telnet
The Telnet protocol allows a user to create a terminal session on a remote
computer and defines for this purpose virtual input and output units (network
virtual terminals) between which connection parameters have to be
negociated.
To get access to another computer using the Telnet command, the other
computer must be running the Telnet Daemon. The standard port for a Telnet
session is Port 23. Other port numbers may be set as parameters, allowing a
connection to be made to other server processes.
As Telnet allows full access to a remote host for a user, this access must be
protected by strong authentication.
A distinction is often made between simple and strong authentication. Simple
authentication uses simple password procedures where the password is
transmitted as plain text and is therefore not protected from eavesdroppers.
Strong authentication, on the other hand, uses more complex procedures
based, for example, on the use of one-time passwords or smart cards.
There is the risk with Telnet that an ‘invader’ may cut into an authorised
Telnet connection during transmission, e.g. to tap classified information or
enter his own commands in the Telnet connection. For this reason encrypted
transmission should be possible.
FTP
The File Transfer Protocol (FTP) allows exchange of files between remote
computers.
When using FTP, two connections are established whereby the commands are
transmitted through port 21 and the data through port 20. To allow the
exchange of commands between computers with different operating systems,
FTP defines a set of standard commands which are not the same as the user
interface commands. The FTP client translates the user interface commands
into the corresponding standard commands. For the firewall it is the standard
commands which are relevant, because these are the only ones actually
transmitted over TCP/IP.
While the client establishes the command connection to the server port 21, the
server is responsible for establishing the data connection from his port 20 to a
client port (> 1023). This constitutes a security weakness, since ‘invaders’
could pretend to be servers. The connection should, therefore, be set up the
other way round and the client should use the standard command PASV
instead of PORT. This forces the server to decide on a random port number
and await the data transfer at this port. The client can then set up a connection
to this port, so that the TCP connection is made from the protected network
into the external one.
All commands which manipulate or read files or directories (CWD, CDUP,
RETR, STOR, DELE, LIST, NLIST), must be linked to a corresponding
authorisation administration. This restricts access to certain files for
untrustworthy users or blocks it altogether. This assumes that a strong
authentication mechanism is in place.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000