Question

I don’t know if jssh has any security built-in. While testing web apps, I would only like to be able to connect to jssh from localhost. I added the following lines to iptables :

iptables -A INPUT -p tcp -s 0/0 --dport 9997 -j LOG
iptables -A INPUT -p tcp -s 0/0 --dport 9997 -j DROP

will they provide the security I need?

EDIT : this is related to programming. The test is written in ruby . But for the test to work, jssh must be enabled. By default, jssh runs on port 9997 and accepts all incoming connections. Once connected, it accepts commands from the connected user. Imagine the potential harm it could do if someone connects to a jssh shell that’s being ran by an user with administrative priviledges .

EDIT2 : Just because I don’t have a problem with the code I write, this doesn’t mean that this question should be dismissed. I think it’s a legitimate question. I would like to know if I have some control over one of the tools I’m using.

Answer 1

Have you tested if the default configuration allows connections from outside localhost?

AFAIK, by default it binds to 127.0.0.1 (only localhost), and not to 0.0.0.0 (all interfaces).