Full Disclosure mailing list archives
Re: closing ports
From: Valdis.Kletnieks () vt edu
Date: Fri, 07 Nov 2003 09:06:22 -0500
On Fri, 07 Nov 2003 08:50:54 +0100, Christ-Henning Ljosheim <chris () megasat no> said:
Do you have any tips for which ports I should close to held my network = clean for intruders ? I've closed port 1214 and 6881 to 6889 . Anyone else I should close ?
Everything you're not actually using. You'll probably find that you only need to have a very few ports open to the outside world. Off the top of my head, those would be 53 (dns), 25 (smtp), 80 (http), 123 (ntp). Other ports should certainly be opened *if* somebody has a reasonable use for them (i.e. don't open ports for P2P filesharing if your network's users shouldn't be using them, but if somebody wants a port open for a good reason, by all means try to do it). One thing you want to make sure you *don't* do is encourage the "everything on port 80 because everybody's firewall will pass 80" type of firewall bypass. This is becoming a major concern for a lot of network operators, because most current routing hardware is able to do traffic engineering based on ports in hardware, but is *not* able to do so on packet contents. As a result, if everybody starts using port 80 for everything, you lose the ability to say things like "traffic for XYZ is allowed to use 10% of the bandwidth". Also, having everything over 80 makes the damage caused by NAT be a lot larger, since although most NAT's let you say things like "forward all port 11923 traffic to A and all port 2397 traffic to B", you can't do this if both are using 80, because you want to forward 80 to your web server....
Attachment:
_bin
Description:
Current thread:
- closing ports Christ-Henning Ljosheim (Nov 07)
- Re: closing ports Charles E. Hill (Nov 07)
- Re: closing ports Valdis . Kletnieks (Nov 07)
- Re: closing ports hena (Nov 07)
- Re: closing ports Valdis . Kletnieks (Nov 07)
- Re: closing ports Blue Boar (Nov 07)
- <Possible follow-ups>
- Re: closing ports marko (Nov 07)
- RE: closing ports Anjan Dave (Nov 07)