Re: Has my server been hacked?

From: Jeff D (xcom_at_bolt.sonic.net)
Date: 03/25/04 

Date: Thu, 25 Mar 2004 04:13:40 GMT

On Wed, 24 Mar 2004, martha wrote:

> I have a server I use for FTP only... it's running redhat 7.3. I ran nmap
> against the box and found a list of ports in "filtered" state I did not
> expect to see. I ran two different commands "netstat -ntupa | grep LISTEN"
> and "lsof -n -P -i tcp | grep LISTEN" and see only the 3 I expect to see
> open (ftp, ssh, and webmin). Is it possible for someone to run other
> programs/open ports that netstat and lsof can't detect? Is there a better
> way of checking?
>
> TIA — Martha (noobie)
>

Do you have iptables/chains running? I am guessing you do. What you are
probably seeing here is nmap saying that it didn't get a response from the
port like it expected to. When a port is closed the server should send a
reset packet back to nmap, it didn't get one for these ports, so it thinks
that its filtered. with iptables you can block port like so:
iptables -I INPUT -p tcp --dport 666 -j DUMP
iptables -I DUMP -p tcp -j REJECT --reject-with tcp-reset

then scan port 666 and it will show closed. if you just -j DROP it will
show as filtered, because iptables just drops the packet ..

also ... if you want to check to see if the port is open, a good way to
check is just to telnet to the port, *most* of the time, not all, but
most, you will get *some* sort of response..

hth,
jeff

Relevant Pages

  • RE: redhat-list Digest, Vol 4, Issue 38
    ... Re: Iptables: port 22 open only for my IP ... Windows Services for Unix 3.5 ... It does absolutely nothing if you have a rampant application on your Windows box that opens a port to the outside world. ...
    (RedHat)
  • Firewall Rules Summary
    ... Subject: Firewall Rules Summary ... This script is provided "as is" with no implied warranty. ... this came from various howtos and articles on iptables that existed around ... #specific port denies>1024 tcp ...
    (Focus-Linux)
  • Re: Linux IPTables tutorial pdfs and plain text available.
    ... What you are referring to here are CHAINS. ... create as a user-defined chain in my iptables scripts to reject traffic ... need to allow port 20/tcp only if you're using active FTP. ... This is actually not a bash script, ...
    (comp.security.firewalls)
  • Re: Mitigating SYN flooding with Netfilter or net.ipv4.tcp_syncookies ?
    ... The only chink, if you will, is the protection ... a port scan, ... The soloution to is to use some of the 'experimental' patches to iptables, ... If you do rate limiting after this rule you will have much fewer syns to ...
    (Focus-Linux)
  • Re: portknocking question
    ... This is nice but still requires closing the port as a step when done. ... you can use a time out with the relevant iptables command ... You can easily close the connection automatically. ... In that example, any existing ssh connection, for example, will continue ...
    (Ubuntu)