telnet security

[adimatteo]

The problem that I have with allowing telnet thru the firewall is that once the client telnets to the destination host, there is no way to restrict them from hopping all over the network. Assuming that the client has full rights to the destination server, is there a product out there that can proxy this connection but not allow the client to jump from that server to another server.

[Richard Burts]

It is NOT true that there is no way to restrict them from hopping all over the network, at least on Cisco routers. While "access-class in" applied to vty will restrict who can telnet to the router, "access-class out" applied to the vty will restrict destinations to which they can telnet. On devices other than routers I am not aware of a solution for your problem.

[adimatteo]

I should have made myself clearer. I am strictly talking about unix and MS server type hosts and not network gear. Thank you for your reply.

[s.uslay]

I quess you need to implement AAA security for the first Telnet box that you are telneting and restrict that particular userid telneting out on that box. Easy to say, might be difficult to implement.

Serhat