🚀 go-pugleaf

In demon.tech.unix Steve Dodd <dirk@loth.demon.co.uk> wrote:
> Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
>> tcp        0      0 *:4383                  *:*                     LISTEN
>> No idea what those were
> Me neither :-(

You can use "lsof" to see which processes have opened these ports.

> As others have suggested, it's probably best to set up your
> firewalling rules (ipmasqadm/ipfwadm/ipchains) to disallow all
> incoming connects except the ones you know you want open (ftp, www).

One caveat - if you do this then all ftp must be "passive" rather than
the older "active" mode which tries to open connections on different
ports.   (I believe there may be workarounds available for this with
newer kernels.)

>> tcp        0      0 *:vboxd                 *:*                    LISTEN
>> tcp        0      0 *:saft                  *:*                    LISTEN

Also note that for (usually) non-privileged ports the service running
will not always match the entry in /etc/services - again: lsof.

>> tcp        0      0 *:finger                *:*                    LISTEN
>> I know this one, but DoS attacks can come from this right?

> Erm, pass. If it's a bog standard finger daemon it should be OK; you might
> want to look at the information it provides and see if you really want to
> make it available.

Running an external finger daemon is next to useless for dial-ups and
you should switch it off unless you have some unusual requirement for
it to be there.

If you have an account on a remote machine (ie a shell account) try
using a port scanning tool[1] such as nmap to scan the ports of your
demon connected box remotely.  The *only* services that should be
available are those you expect to be open. Ideally, for most dial-up
users this should be none. (ports for smtp, ntp, nntp, etc should have
access restricted via packet filtering to the required ranges.)

[1] Ensure you have permission from yourself before attempting to scan
    your own machine.
-- 
Lee Maguire <{$news-reply$}@wetware.demon.co.uk>