SECURITY: SERVERS & SERVICES


You may not be aware of it but there are often running servers or sevices that listen to ports on your system that are unsafe.

The SANS top 20 http://www.sans.org/top20/

So let us do some real work now to secure our system:

There is this command ( as root )
 

That will show you the active servers on your system and what port they listen to . . . . but this needs far more information . . . . let us say that in general only the services you allowed running above should be seen in there . . .

Example:

( This one is okay, the cups printer deamon, and needs to be running ! )

Another command is:
 

It shows you the same servers, but now with the port numbers they listen to.

So, like I said, the cupsserver is okay, but if any of the following servers are active and in LISTEN mode, it would be safer to shut them down:

finger
ftpd
kdessh
lockd
mountd
named or BIND
nfsd
rpc
rlogin
rsh
sendmail ( Only needed if you run a mailserver )
snmp
ssl
ssh
statd
ruser
telnetd
X ( the part that listens to tcp )

And, if you're not running a web server, you should also shut down any running httpd process.


You can shut down the processes for the current session with "kill PID" ( where PID is the number you see just before the name of the service . . in our example it would be: 1662 )
To prevent those services from starting up at boot permanently ( and they are not in the MCC "services" tool ) you will have to edit the /etc/inetd.conf file.
A radical way to do this is back up the old /etc/inetd.conf file:
 

and replace it by an empty file:
 

. . This will eliminate most of the ones listed above that can not be found in the MCC.

Then to stop X from listening to a certain port:
In Mandrake and PCLos: add the bold part to the last line in the "/etc/X11/xdm/Xservers" file:

In Slackware: add the bold part to the last line in the "/etc/X11/xdm/Xservers" file:

After this exercise the two commands I gave you above ( netstat and nmap ) should return no entries then only cupsd. And maybe the samba, mail or webserver you absolutely want running.

Have FUN securing your system . . . next time we look at rootkits

A last one for our Slackware users . . to disable sshd:

Bruno


-- Apr 21 2004 ( Revised Dec 13 2005 ) --