Are ports above 1024 closed by default ? Post: 302253187

Sponsored Content

Top Forums UNIX for Advanced & Expert Users Are ports above 1024 closed by default ? Post 302253187 by nobo on Friday 31st of October 2008 06:25:37 AM

10-31-2008

Registered User

Nothing is blocked by default.

To see what processes are listening on what ports, use netstat, eg for a telephony server @ my shop:

Code:

[root@server ~]# netstat -tlnp | head -5
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      PID/Program name
tcp        0      0 0.0.0.0:199                 0.0.0.0:*                   LISTEN      30962/snmpd
tcp        0      0 0.0.0.0:8009                0.0.0.0:*                   LISTEN      6051/java
tcp        0      0 0.0.0.0:4201                0.0.0.0:*                   LISTEN      6051/java
[root@server ~]# netstat -ulnp | head -5
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      PID/Program name
udp        0      0 0.0.0.0:19342               0.0.0.0:*      6123/asterisk
udp        0      0 0.0.0.0:19343               0.0.0.0:*      6123/asterisk
udp        0      0 0.0.0.0:161                 0.0.0.0:*      30962/snmpd
[root@server ~]#

As you can see, this is listening on ports over 1024. There are many other things to notice. 'man netstat' for more options.

This is much more important than your firewall. Turn off all but unneccessary services. For instance, I betcha that "cupsd" is running. You don't want that unless the box in question is a printserver, listening on the IP associated w/the configured interface.

As to your firewall, you're going about the whole thing the wrong way. You want to DROP packets by default, then add your allow rules. To this end, this is typically found at the beginning of a firewall script / config file:

Code:

*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]

BTW, "DROP" is pref'd over "REJECT". REJECT returns a "nobody home". DROP drops the packets silently. Suggest you man iptables. Google the "Unreliable Guides" by the module's author. Also, there are many sample firewalls out there.

regards
nobo

nobo

View Public Profile for nobo

Find all posts by nobo

8 More Discussions You Might Find Interesting

1. Cybersecurity

Allowing access to ports < 1024 w/o root

I need to set up an application to run in a script which will be running as a web server but is a database. I need to allow users to use the web server but the app must be run as root in order for the ports to be accessible. This is not a very secure environment would like to know how this could...

2. UNIX for Dummies Questions & Answers

Closed ports

Hello I need to close some ports on a box Solaris 8, which command I need to use. Thanks for your replies

3. UNIX for Dummies Questions & Answers

ssh_exchange_identification: Connection closed by remote host Connection closed

Hi Everyone, Good day. Scenario: 2 unix servers -- A (SunOS) and B (AIX) I have an ftp script to sftp 30 files from A to B which happen almost instantaneously i.e 30 sftp's happen at the same time. Some of these sftp's fail with the following error: ssh_exchange_identification: Connection...

4. Red Hat

ssh_host_rsa_key 1024 bit?

Hi All, How do I know if ssh_host_rsa_key is 1024 bit? cat /etc/ssh/ssh_host_rsa_key | wc -m 887 It's only 887. Is that it? Or not? Thank you for any comment you may add.

5. UNIX for Dummies Questions & Answers

RSA 1024

How to generate RSA 1024 public key?? Pls help

6. Shell Programming and Scripting

1024 field issue : awk

Hi i have a txt file in which i do a awk operation with ":" as field separator A B C D ABC::2386.13:2386.13:3248234281995::+DPY:INT:3:N::::2:200.00:0.00:2010-05-12:CA: ::2:N::N:PH:00010031:0001+DPY:BAL:3:N::::3:1601.01:0.00:2010-05-12:XT::2:N:MR ...

7. Solaris

SYN_SENT does not receive reset from closed ports

Dear all, I have a Solaris 10 system with a bunch of zones on it. My issue is the following: - I have application A and B running in the same zone: i.e. they communicate via loopback interface. Application A tries to connect to application B, usually listening on port X. If application B...

8. IP Networking

Debian ports reporting closed. Refused connection

Hey guys, I'm having trouble with checking what ports are open on my Debian distro, which is reporting all ports closed, though they are clearly open I am checking to see if ports are open with netcat: nc 127.0.0.1 80 localhost 80 (http) : Connection refusedAs an example but on all ports...

LEARN ABOUT MOJAVE

vdltodmx

vdltodmx(1)						      General Commands Manual						       vdltodmx(1)

NAME

       vdltodmx - dmx configuration file parser and printer

SYNOPSIS

       vdltodmx infile outfile

DESCRIPTION

       vdltodmx  reads	the  input file, which should be in VDL configuration file format.  After a successful parse, a file in Xdmx configuration
       file format is written to the output file.

       The VDL file format is used with xmovie, which is available from http://www.llnl.gov/icc/lc/img/xmovie/xmovie.html

EXAMPLE

       Given the following VDL-format file:
	      0
	      2
	      #
	      #
	      2560 2048 Left two-thirds [restrict=*:2]
	      2
	      :2.1 1280 2048   0    0 0 0
	      :2.2 1280 2048   1280 0 0 0
	      4
	      1280 1024 0      0
	      1280 1024 0      1024
	      1280 1024 1280   0
	      1280 1024 1280   1024
	      #
	      2560 2048 Right two-thirds [restrict=*:2]
	      2
	      :2.2 1280 2048   0   0 0 0
	      :2.3 1280 2048   1280 0 0 0
	      4
	      1280 1024 1280	0
	      1280 1024 1280	1024
	      1280 1024 2560 0
	      1280 1024 2560 1024
       the following DMX-format file will be produced:
	      #
	      #
	      virtual "Left two-thirds" 2560x2048 {
		  display :2.1 1280x2048;
		  display :2.2 1280x2048 @1280x0;
	      }
	      #
	      virtual "Right two-thirds" 2560x2048 {
		  display :2.2 1280x2048;
		  display :2.3 1280x2048 @1280x0;
	      }

BUGS

       If the VDL file is not in the expected format, the program will probably dump core.

SEE ALSO

       Xdmx(1), xdmxconfig(1), vdl(3), xmovie(1)

X Version 11							xorg-server 1.12.4						       vdltodmx(1)