Too many UDP ports open

[Saeed42]

I only have few services running, please see below for chkconfig output, but if I scan my redhat8 server I have few UDP ports open and they are

88 Kerberos 5
123 NTP
138 Netbios-DGM
161 SNMP
520 RIP
1433 ms-sql
1512 win

My question is how can I block these ports or stop their services as I don't need any of those services running.

please I'm a newbie so go easy on me


More info



syslog 0ff 1ff 2n 3n 4n 5n 6ff
network 0ff 1ff 2n 3n 4n 5n 6ff
random 0ff 1ff 2n 3n 4n 5n 6ff
rawdevices 0ff 1ff 2ff 3n 4n 5n 6ff
xinetd 0ff 1ff 2ff 3n 4n 5n 6ff
atd 0ff 1ff 2ff 3n 4n 5n 6ff
gpm 0ff 1ff 2n 3n 4n 5n 6ff
autofs 0ff 1ff 2ff 3n 4n 5n 6ff
keytable 0ff 1n 2n 3n 4n 5n 6ff
kudzu 0ff 1ff 2ff 3n 4n 5n 6ff
sshd 0ff 1ff 2n 3n 4n 5n 6ff
iptables 0ff 1ff 2n 3n 4n 5n 6ff
nfslock 0ff 1ff 2ff 3n 4n 5n 6ff
rhnsd 0ff 1ff 2ff 3n 4n 5n 6ff
crond 0ff 1ff 2n 3n 4n 5n 6ff
anacron 0ff 1ff 2n 3n 4n 5n 6ff
xfs 0ff 1ff 2n 3n 4n 5n 6ff
vncserver 0ff 1ff 2ff 3ff 4ff 5n 6ff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[sco21]

TIP:
By the way if you run a WINS servise on your windows mashine
stop it and run Languard again....
and see if the
wins 1512/tcp Microsoft's Windows Internet Name Service
wins 1512/udp Microsoft's Windows Internet Name Service

exists again in the results. =-=-=-=-=-=-=-=-=-=-=-=
Unix Systems Engineer
=-=-=-=-=-=-=-=-=-=-=-=

 

[Saeed42]

Found this little script Bastille (

http://www.bastille-linux.org/)

which is a wizard that helps novices like me build secure Linux servers and that made my life that much easier.

Thanks for your help.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[marsd]

As I said before on this topic, what your scanner reports
as open, closed,filtered, unfiltered, etc.. depends on the author as much as the reality of what services are binding sockets.

Next time run lsof -i -n as root on your server to see
a listing of your services binding sockets and then use
a decent network test suite like nessus or saint to corroborate if you must.
nmap and other "scanners" are not infallible, or logical,
all the time.