Why open? How do I close?

From: Patrick Cairpre (cairpre409_at_yahoo.com)
Date: 09/18/03

  • Next message: Peter Richards: "Re: Security and CGI-BIN path ?" 
    Date: 17 Sep 2003 19:49:53 -0700

    I am running redhat 9 using their standard firewall. I thought that
    only the ports I explicitly opened would be open. In addition to the
    ones that I did open an online security scan has found the following
    ports open.

    TCP
    111
    113
    139
    143
    443
    688
    696
    709
    879
    901
    935

    I don't understand why these ports are open? How do I lock them down?

    I expicitly left port 153 open to udp so that my dns would update my
    secondary.
    But the scan shows no ports open for udp.

    ****************
    This is my iptables file:

    # Firewall configuration written by lokkit
    # Manual customization of this file is not recommended.
    # Note: ifup-post will punch the current nameservers through the
    # firewall; such entries will *not* be listed here.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :RH-Lokkit-0-50-INPUT - [0:0]
    -A INPUT -j RH-Lokkit-0-50-INPUT
    -A FORWARD -j RH-Lokkit-0-50-INPUT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 53 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 53 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 119 --syn -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
    -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
    -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j
    REJECT
    -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
    COMMIT
    ************

    I know this is a fairly primative firewall that has other problems,
    but why is it not doing what it is supposed to?
    I think there are some basics I am misunderstanding.
    Can someone point me in the right direction?

    Thanks

  • Next message: Peter Richards: "Re: Security and CGI-BIN path ?"

    Relevant Pages

    • Re: Root exploit for FreeBSD
      ... for two ports to my FreeBSD portscluster nodes. ... and it gives the firewall ... US this is also quite common, at least with regards to University ... if your computer is going to connect on our network it must be configured in certain ways and behave "normally" or you won't get a connection. ...
      (freebsd-questions)
    • Re: Root exploit for FreeBSD
      ... for two ports to my FreeBSD portscluster nodes. ... and it gives the firewall ... US this is also quite common, at least with regards to University ... if your computer is going to connect on our network it must be configured in certain ways and behave "normally" or you won't get a connection. ...
      (freebsd-current)
    • Re: Samba wont dance [Solved - sort of]
      ... Left the firewall turned on when I went to bed. ... I saw neither these descriptions (tcp or udp) nor their 137/138 numbers ... was simply noting the lack of presence of those ports in your listing. ...
      (Fedora)
    • Re: Trouble accessing Outlook Web Access from behind firewall
      ... When starting the firewall I also set ... > rejected and dropped packets are logged, however I see nothing in my log ... > # Higher ports needed to accept incoming/outgoing calls ...
      (comp.security.firewalls)
    • Re: Firewall rules to allow Windows 2000 updates
      ... The choice for the firewall is TDP, UDP, ICMP, or other. ... and ports. ... Transmission protocols and ports: The transmission protocols and ...
      (microsoft.public.security)