Message-ID: <200311071406.hA7E6Me8016864@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: closing ports 

On Fri, 07 Nov 2003 08:50:54 +0100, Christ-Henning Ljosheim <chris@...asat.no>  said:

> Do you have any tips for which ports I should close to held my network =
> clean for intruders ?
> I've closed port 1214 and 6881 to 6889 . Anyone else I should close ?

Everything you're not actually using.  You'll probably find that
you only need to have a very few ports open to the outside world.
Off the top of my head, those would be 53 (dns), 25 (smtp), 80 (http),
123 (ntp).

Other ports should certainly be opened *if* somebody has a reasonable
use for them (i.e. don't open ports for P2P filesharing if your network's
users shouldn't be using them, but if somebody wants a port open for
a good reason, by all means try to do it).

One thing you want to make sure you *don't* do is encourage the "everything on
port 80 because everybody's firewall will pass 80" type of firewall bypass.
This is becoming a major concern for a lot of network operators, because most
current routing hardware is able to do traffic engineering based on ports in
hardware, but is *not* able to do so on packet contents.  As a result, if
everybody starts using port 80 for everything, you lose the ability to say
things like "traffic for XYZ is allowed to use 10% of the bandwidth".

Also, having everything over 80 makes the damage caused by NAT be a lot
larger, since although most NAT's let you say things like "forward all
port 11923 traffic to A and all port 2397 traffic to B", you can't do
this if both are using 80, because you want to forward 80 to your web
server....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031107/eb580bf3/attachment.bin

Powered by blists - more mailing lists