🚀 go-pugleaf

On 12 Dec 1999, Steve Dodd wrote:

> Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
>> tcp        0      0 *:nntp                  *:*                     LISTEN
>> My NTP server???
> 
> NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
> leafnode (does anyone know if the latter has an NNTP interface?). You ought
> to make sure that no unauthorised bods can post through it; you probably
> don't want anyone reading from it either over a dial-up link, however public
> spirited you are. I regularly see people probing my news server, presumably
> look for an open one to spam Usenet through.

I used to restrict access to leafnode with tcpwrappers... but I somehow still
managed to get into an open NNTP server list (probably because the connection
is first accepted before being told where to go by tcpwrappers). I now use
ipchains so only my localnet can see it, everyone else gets Connection
Refused.

>> tcp        0      0 *:ftp                   *:*                    LISTEN
>> I need this
> 
> Fair enough :-) Just make sure there aren't any known exploits in the ftpd
> you're running. If you've got anonymous ftp enabled, make sure there's nothing
> in ~ftp you don't want people to see.

Ditto. I just use it when sharing files with friends... and it gets removed
straight afterwards.

>> tcp        0      0 *:www                   *:*                    LISTEN
>> And this
> 
> AFAIK, the biggest security problems with web servers are any CGI scripts that
> might be available, so check those out.

This is where I've taken an odd approach. The front page as accessed by my
real hostname is the standard Eridani Linux / Apache age saying I got it
right. I do use my web server for developing stuff, and that material is only
accessible when it's referred to using my localnet hostname and IP address.

And, no, I have no CGI scripts available on my 'real hostname' front.

>> tcp        0      0 *:printer               *:*                    LISTEN
>> Do I need this?  lpr does the printing AFAIK
> 
> Only if you want to print remotely - I don't know much about this, I'm
> afriad.

I think it's also needed for local printing. Probably something else I ought
to firewall. *HINT* My printer is only switched on when needed, before anyone
gets any funny ideas ;)

>> tcp        0      0 *:finger                *:*                    LISTEN
>> I know this one, but DoS attacks can come from this right?
> 
> Erm, pass. If it's a bog standard finger daemon it should be OK; you might
> want to look at the information it provides and see if you really want to
> make it available.

That's one I keep disabled. I don't want people knowing which user ids are
real or when I last read my email...

>> tcp        0      0 *:smtp                  *:*                    LISTEN
>> tcp        0      0 *:pop3                  *:*                    LISTEN
>> I need those two, but perhaps I could place IP restrictions...  ?
> 
> You can probably restrict access to the SMTP server to Demon's mail subnet
> (which I can't remember off hand, it must be documented somewhere) and any
> where you might want to send mail from (probably just your local address).
> For the pop3 server, anywhere you want to pick mail up from (again,
> probably just your local address).

194.217.242.*

...and I don't run a pop3 server.

> > tcp        0      0 *:telnet                *:*                    LISTEN
> > Need this
> 
> Better to use ssh if you can; unless you're using something fancy like IPsec,
> your passwords as well as your session data will go across the internet in
> the clear with regular telnet.

I'm running both, with access restriction so telnet access only works for
those who can't for whatever reason use SSH.

I'm running Eridani Linux 6.1A, based somewhat on Red Hat Linux 6.1.

-- Michael "Soruk" McConnell		     [Eridani Linux 6.1A available]
Eridani Linux  --  The Most Up-to-Date Red Hat-based Linux CDROMs Available
Email: linux@eridani.co.uk  http://www.eridani.co.uk   Fax: +44-8701-600807
    "No. 'Eureka' is Greek for 'This bath is too hot.'" - Dr Who.