OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: closing network ports
From: Eric Sherrill (sherrillTI.COM)
Date: Wed Jul 12 2000 - 18:58:49 CDT

Also don't forget if you're running NIS or NIS+ to check the services maps
(e.g. ypcat -k services) and/or use only "services: files" in your
/etc/nsswitch.conf (I believe that is the default but check anyway). Of
course you probably shouldn't be running either (especially NIS) on an
internet-exposed host IMHO ;-). 

--
Eric R. Sherrill, WF Software Systems Engineer
Texas Instruments HFAB1 Automation Systems
Stafford, TX 77477-3006
281-274-4133

-----Original Message-----
From: Focus on Sun Mailing List [mailto:FOCUS-SUNSECURITYFOCUS.COM]On
Behalf Of Derrick Daugherty
Sent: Wednesday, July 12, 2000 12:03 PM
To: FOCUS-SUNSECURITYFOCUS.COM
Subject: Re: closing network ports

You can use netstat -a to map back to your /etc/services file and that
might give you a clue of what services are running.  Most scanners would
do a similar lookup.  `lsof` will allow you to find out the local pid
of the process bound to the socket.

lsof -i tcp:25   will print out all services bound to the smtp port

$ lsof -i tcp:22
COMMAND   PID USER   FD   TYPE     DEVICE SIZE NODE NAME
ssh1     4409 root    3u  IPv4 1026235888       TCP
tachyon.pointone.com:1023->somehost.pointone.com:ssh (ESTABLISHED)

Some version of fuser will as well ( fuser smtp/tcp  would show you all
process etc).

HTH
-D

It's rumored that around Tue, Jul 11, 2000 at 11:57:49PM -0400
Alan Rubin <rubinEZY.NET> wrote:
> What is the process for closing UDP and TCP ports that are not listened
> for in inetd.conf and other known daemons, but appear to be open after
> doing a network scan?  This is on a Sol 2.6 Ultra 10.
>
> Alan Rubin
> rubinezy.net
>
> _________________
> *Alan Rubin*
> Sun/Unix/Networking/ISP/Web Writing
> Email:rubinezy.net

--
.   . .................... .. . .. .................... .   .
:       Derrick Daugherty    .:.      512.381.8952          :
:                Point One Telecommunications               :
: UNIX/Security Administration     ddaughertypointone.com  :
:..............home is where the console is.................: