making services invisible
Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule:
iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port <port1>,<port2>,<blablabla> -j REJECT
However, when I perform a stealth scan using nmap on my host, I still can see them running, but instead of "opened" I get them as "filtered". Is there a way to block these results, making the services literally invisible ? Appreciate any help, and also any technical information (links, docs) regarding the answer.
Julio Cesar Ody
Use DROP instead of REJECT.
REJECT action tells tables to send back an ICMP message indicating that you're REJECTing the packet. DROPing will just DROP with no further action.
--
On Thu, 2002-10-10 at 09:13, Julio Cesar Ody wrote:
Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule:
iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port <port1>,<port2>,<blablabla> -j REJECT
However, when I perform a stealth scan using nmap on my host, I still can see them running, but instead of "opened" I get them as "filtered". Is there a way to block these results, making the services literally invisible ? Appreciate any help, and also any technical information (links, docs) regarding the answer.
Julio Cesar Ody
Quoted 5 lines · Julio Cesar Ody
Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule:
iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port <port1>,<port2>,<blablabla> -j REJECT
Use DROP not REJECT, with REJECT you send an ICMP message, so it's filtered, not close
Signature · 2 lines
Éric Leblond courriel : [email protected]
DROP would make nmap ( or any other scanner ) mark that port as filtered
too. To make services closed and 'invisible' to scanners, you should use '-j REJECT --reject-with tcp-reset'.
Sincerily,
Leonardo Rodrigues
----- Original Message -----
From: "Eric Leblond" <[email protected]>
To: <[email protected]>
Sent: Thursday, October 10, 2002 10:46 AM
Subject: Re: making services invisible
Quoted 5 lines · Julio Cesar Ody
Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule:
iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port <port1>,<port2>,<blablabla> -j REJECT
Use DROP not REJECT, with REJECT you send an ICMP message, so it's filtered, not close
Quoted 4 lines · Leonardo Rodrigues ( listas )
DROP would make nmap ( or any other scanner ) mark that port as filtered
too. To make services closed and 'invisible' to scanners, you should use '-j REJECT --reject-with tcp-reset'.
Spot on :)
Isn't this one in an FAQ somewhere by now, seeing as no-one ever reads the rather good nmap man page.
I haven't checked but last time I looked the TTL will be different with RSTs sent from iptables rather than those sent because there's no listener on the port. There are ways around this too, depends how invisible you want to be...
Signature · 1 line
FunkyJesus System Administration Team
How will stop follwoing service
Hi,
I am running Redhat Linux, How will I stop following process. I checked in chkconfig and /etc/xinetd. directory, I don't get any information.
111/tcp open sunrpc 1024/tcp open kdm 1025/tcp open listen
Thanks
Sundaram
On Thu, 10 Oct 2002, Julio Cesar Ody transmitted the following:
Quoted 11 lines
Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule:
iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port <port1>,<port2>,<blablabla> -j REJECT
However, when I perform a stealth scan using nmap on my host, I still can see them running, but instead of "opened" I get them as "filtered". Is there a way to block these results, making the services literally invisible ? Appreciate any help, and also any technical information (links, docs) regarding the answer.
You need to reply with an RST.
Something like: --reject-with tcp-reset
/* Kevin Dwyer Allegiance Internet */
/* network security engineer Commerce Center II */
/* email: [email protected] 7601 Ora Glen Drive */
/* phone: 240-616-2075 Greenbelt, MD 20770 */
/* >++++++++++[<++++++++++>-]<.+++++.----.[-]++++++++++. */