How to disable a port on my system ?

[Johnthom]

Hi everybody,

Please tell me how to disable a port ( for example port TCP 447 ) on my computer. And tell me a software to scan all opened ports on my computer. Tel me ports I should open/close for security ( my computer is mail server only ).

Thanks in advance.

John Thom

 

[ifincham]

Hi,

On Linux this is very easy using the firewalling/packet filtering utilities ipchains or iptables (the latter with effect from 2.4 series kernels only).

To scan yourself the best is nmap which can also be run from gui with nmap-front end. See -->

http://insecure.org/nmap/

for info and downloads. Some linux distros have rpms available as part of the standard distribution and you just have to install them. For redhat try these :

http://www.mirror.ac.uk/sites/ftp.r...ls/i386/RedHat/RPMS/nmap-2.54BETA7-3.i386.rpm

&

http://www.mirror.ac.uk/sites/ftp.r...edHat/RPMS/nmap-frontend-2.54BETA7-3.i386.rpm

To run the gui just open a console window, su to root, and do 'nmapfe &' . (If you don't run as root you can't do everything). Then just put your ip address and run a syn-stealth scan as a first try. Its best to do this from 'outside' really to see how your system looks to a potential cracker/hacker (sic). For info on ports an sploits see -->

http://www.networkice.com/advice/Exploits/Ports/

.

When you invoke ipchains/iptables you really have two choices. You can set the default to allow everything and then write rules to block specifics or (better) set the default to drop everything and write rules that specifically allow what is necessary. Its quite a big subject really and there are various tools that will generate ipchains/iptables rules for you via a gui. For example, redhat 7.x has a utility called 'lokkit' which generates a ipchains script. Most other up-to-date distros have similar facilities or you can download other packages. For ipchains see -->

http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html

. For iptables see -->

http://netfilter.samba.org/unreliable-guides

A typical iptables rule for port 447 would look something like this :

iptables -A INPUT -i eth0 -s 0/0 --dport 447 -j DROP

(just an extract - not much use on its' own!)

Hope this helps