Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 54)

Looking at /etc/services, we can tell that port 37 is a "time" service, which is a time server. 6000 is

X11, and 80 is the standard port for HTTP servers like Apache. There is nothing really unusual here as these

are all readily available services on Linux.

The first two above are definitely not the kind of services you'd want just anyone to connect to. These should

be firewalled so that all outside connections are refused. Again, we can't tell from this output whether any

firewall is in place, much less how effectively implemented it may be.

The web server on port 80 is not a huge security risk by itself. HTTP is a protocol that is often open to all

comers. For instance, if we wanted to host our own home page, Apache can certainly do this for us. It is also

possible to firewall this off, so that it is for use only to our LAN clients as part of an Intranet. Obviously too,

if you do not have a good justification for running a web server, then it should be disabled completely.

The next two lines are interesting:

tcp 0 0 192.168.1.1:53 0.0.0.0:* LISTEN

tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN

Again notice the "Local Address" is not 0.0.0.0. This is good! The port this time is 53, or the DNS port

used by nameserver daemons like named. But we see the nameserver daemon is only listening on the lo

interface (localhost), and the interface that connects bigcat to the LAN. So the kernel only allows connections

from localhost, and the LAN. There will be no port 53 available to outside connections at all. This is a good

example of how individual applications can sometimes be securely configured. In this case, we are probably

looking at a caching DNS server since a real nameserver that is responsible for handling DNS queries would

have to have port 53 open to the world. This is a security risk and requires special handling.

The last three LISTENER entries:

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN

These are back to listening on all available interfaces. Port 22 is sshd, the Secure Shell server daemon. This is

a good sign! Notice that the service for port 631 does not have a service name if we look at the output in the

first example. This might be a clue that something unusual is going on here. (See the next section for the

answer to this riddle.) And lastly, port 25, the standard port for the SMTP mail daemon. Most Linux

installations probably will have an SMTP daemon running, so this is not necessarily unusual. But is it

necessary?

The next grouping is established connections. For our purposes the state of the connection as indicated by the

last column is not so important. This is well explained in the man page.

tcp 0 1 169.254.179.139:1174 64.152.100.93:119 SYN_SENT

tcp 0 1 169.254.179.139:1175 64.152.100.93:119 SYN_SENT

tcp 0 1 169.254.179.139:1173 64.152.100.93:119 SYN_SENT

tcp 0 0 169.254.179.139:1172 207.153.203.114:80 ESTABLISHED

tcp 1 0 169.254.179.139:1199 216.26.129.136:80 CLOSE_WAIT

tcp 0 0 169.254.179.139:80 63.236.92.144:34197 TIME_WAIT

tcp 400 0 127.0.0.1:1152 127.0.0.1:8000 CLOSE_WAIT

Security Quick−Start HOWTO for Red Hat Linux

8.3. Netstat Tutorial 51

1 2 ... 49 50 51 52 53 54 55 56 57 58 59 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 54