[SLE] Firewall2 : How to open and close ports

[Jacob Fierberg]

I finally have the firewall up but after doing an nmap localhost I found
several ports open that should not be. How do I close the ports? How do I
open the ftp port? I have already modified firewall2.rc.config and added
the "ftp" to the list of ports allowed. Interestingly enough the open ports
do not correspond the ones in firewall.rc.config. Any ideas? Is there a
gui for SuSEFirewall2? AGGGHHHH!

Jacob Fierberg
Help Desk
Teacher's Pal, Inc
***@teacherspal.com
www.teacherspal.com <www.teacherspal.com>
10851 N. Black Canyon Highway, Suite 500
Phoenix, AZ 85029
800-515-2535 toll-free
602-861-3440 telephone
602-789-6077 fax

[Anders Johansson]

Post by Jacob Fierberg
I finally have the firewall up but after doing an nmap localhost I found
several ports open that should not be.

Don't do an an nmap against the localhost. You'll get a completely misleading
result. The firewall only protects against connections from other machines,
not from connections from itself. So, as an example, even though my firewall
blocks port 515 I'm still perfectly able to print fron localhost. Even though
I block port 80 I'm still perfectly able to browse my local pages from
localhost.

If you want to verify your firewall, find another machine and nmap from there.

regards
Anders

[Tony White]

Post by Jacob Fierberg
I finally have the firewall up but after doing an nmap localhost I found
several ports open that should not be. How do I close the ports? How do I
open the ftp port? I have already modified firewall2.rc.config and added
the "ftp" to the list of ports allowed. Interestingly enough the open ports
do not correspond the ones in firewall.rc.config. Any ideas? Is there a
gui for SuSEFirewall2? AGGGHHHH!

Are you *really* firewalling the loopback interface on localhost? Or more
likely an ethernet port, or ppp port (ie external interfaces).

You need to run nmap from another machine on the external network, aimed at
the ip address of your external interface. Running nmap on localhost will
not tell you anything about how your firewall is behaving on the external
interface.

Tony

[Anders Johansson]

I'm posting to the list since I can't seem to get through to your email
address.

I did another nmap on the external ip and I also had the folks at GRC.com
run a "sheildsup" scan of my firewall and found the following ports open
(telnet, finger, pop3 and ident). According to them ftp is closed as well.
Any ideas how to lock down the open ports?

grc.com is not reliable. It can show closed ports open and it can show open
ports closed. Did the nmap results show the same? Was the nmap run from
another machine, or did you run from localhost but you used the ip of the
external NIC? Don't do that! Use another machine!

ident is filtered by SuSEfirewall in a special way that make the port appear,
but not used. This is because if it was completely blocked, some services
on the net, such as mail, would take an enormous amount of time to run.

The other services you mention are all controlled from inetd. You can check if
they are used by grepping in /etc/inetd.conf

grep telnet /etc/inetd.conf

for instance, on my machine, gives

# If you want telnetd not to "keep-alives" (e.g. if it runs over a ISDN
# uplink), add "-n". See 'man telnetd' for more details.
telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
# Try "telnet localhost systat" and "telnet localhost netstat" to see that

Lines 1,2 and 4 are obviously comments. The third line is the service line. If
it starts with a # it isn't used. As you can see, my telnet is used. Is your
telnet line uncommented? If it is, you'll know you can't trust the result of
the scan.

If the above doesn't help, use this command

/sbin/iptables -L

to see if the firewall rules are loaded at all.

Post back to the list with your progress, or if you have more questions

regards
Anders

[Tony White]

In regards to your question of whether I am really firewalling, I am not
sure. This is a new thing for me. I know that all of my internal pc's use
this machine to gain access to the web and this machine is supposed to allow
certain requests for information to passthru it (ftp and email). I used an
outside source to determine that my ftp port is closed and the following
ports are open:finger, pop3, telnet and inet. So how do I close those and
open the ftp one.

Hi Jacob,

1) It's generally useful to post to the list, rather than direct - so that
others can see *all* messages in a thread, and respond, or also learn from
this.

2) I've just seen your earlier post (START_FW2yes problem) - did you
resolve that, and get the firewall to load on boot? You should see three
phases of firewall initialisation in the boot messages (which should all
report 'passed')

3) If you can describe your network topology, (and what services you *do*
want - I can try to help you with what you need in your firewall2.rc.config
- but it is commented quite well, and should be easy to set up.

Rgds,
Tony

[Jacob Fierberg]

I edited /etc/inetd.conf and commented out the items I did not want accessed
and rebooted the firewall. Now those ports are showing as closed. I think
the problem is resolved. Any suggestions?

Ya I resolved the Start_fw2 thing. The rc.config file had two instances of
the START_FW2=YES line. I only saw the one at the bottom of the page. The
one in the middle was the one that was written wrong, no equals sign.


-----Original Message-----
From: Tony White [mailto:***@databit.net]
Sent: Tuesday, September 10, 2002 2:33 PM
To: suse-linux-***@suse.com
Subject: RE: [SLE] Firewall2 : How to open and close ports

In regards to your question of whether I am really firewalling, I am
not sure. This is a new thing for me. I know that all of my internal
pc's use this machine to gain access to the web and this machine is
supposed to allow certain requests for information to passthru it (ftp
and email). I used an outside source to determine that my ftp port is
closed and the following ports are open:finger, pop3, telnet and inet.
So how do I close those and open the ftp one.

Hi Jacob,

1) It's generally useful to post to the list, rather than direct - so that
others can see *all* messages in a thread, and respond, or also learn from
this.

2) I've just seen your earlier post (START_FW2yes problem) - did you
resolve that, and get the firewall to load on boot? You should see three
phases of firewall initialisation in the boot messages (which should all
report 'passed')

3) If you can describe your network topology, (and what services you *do*
want - I can try to help you with what you need in your firewall2.rc.config
- but it is commented quite well, and should be easy to set up.

Rgds,
Tony
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com Also check
the archives at http://lists.suse.com Please read the FAQs:
suse-linux-e-***@suse.com

[Tony White]

Post by Jacob Fierberg
I edited /etc/inetd.conf and commented out the items I did not want accessed
and rebooted the firewall. Now those ports are showing as closed. I think
the problem is resolved. Any suggestions?

Yep - if they are inetd services, and you comment them out, they'll be
closed alright - those services just won't be available to anyone on any
interface, even localhost!

That's not firewalling (well... in a sense... ) A firewall *allows*
services to run, but selectively blocks services on certain interfaces
according to firewall rules (which with SuSEfirewall2 are using iptables
*not* ipchains)

These rules get very complex, but SuSEfirewall 2 is a script which will set
up these rules for you by answering some fairly straightforward questions
in the config file (firewall2.rc.config). The file is well commented - and
the docs and examples give more help. have a read of those, and come back
if you still can't get things working.

Tony

[Landy Roman]

howwould i close this one
xxx/tcp open unknown

[Tony White]

Post by Landy Roman
howwould i close this one
xxx/tcp open unknown

Where's it coming from?

If you run <lsof -i> you will get a list of open ports currently in use
(ie. things you probably *don't* want to disable as services) but probably
want to restrict access from eg. your internet interface.

In SuSEfirewall2, everything is closed until you open it for that interface
- IIRC section 9 of firewall2.rc.config.

Don't be misled by what you think is open - it may be open in the sense
that local services on localhost require it - but it should be closed on
any external interface, except where you have explicitly opened it in the
firewall config for a particular interface.

Tony

[Landy Roman]

On Wed, 11 Sep 2002 13:51:25 +0300

Post by Tony White

Post by Landy Roman
howwould i close this one
xxx/tcp open unknown

i got it from nmap localhost

Post by Tony White
Where's it coming from?
If you run <lsof -i> you will get a list of open ports
currently in use (ie. things you probably *don't* want to
disable as services) but probably want to restrict access from
eg. your internet interface.
In SuSEfirewall2, everything is closed until you open it for
that interface - IIRC section 9 of firewall2.rc.config.
Don't be misled by what you think is open - it may be open in
the sense that local services on localhost require it - but it
should be closed on any external interface, except where you
have explicitly opened it in the firewall config for a
particular interface.
Tony
--
Check the headers for your unsubscription address
For additional commands send e-mail to
http://lists.suse.com

[jaakko tamminen]

Hi

Post by Landy Roman

Post by Landy Roman
xxx/tcp open unknown

Could You be more specific, because that does NOT tell us anything where it
might come from. Please give the port number, it is not a secret!

Post by Landy Roman
i got it from nmap localhost

Again, that does not reveal, if the port is seen "on the other side" of the
firewall.. Do You have Your firewall set up so, that it allows the "xxxx"
port communication? Then it would be available to "outside" too...

You can have something in Your /etc/inetd.conf set up so, that it responds to
that port, or the there is some other process running in background (or as a
user-task) that listens to that port.

Without knowing the port (and thus the service), we don't have no way to tell
You how to fix it, because determing the source is impossible.

Jaska

[Anders Johansson]

When I try to mail you directly I keep getting timeouts.

finger, telnet, pop3. I went into /etc/inetd.conf and commented them out
but I guess that did not do a lot. I tried the /sbin/iptables -L thing but
got an error that says the iptables do not exist. I tried using ipchains
but the kernel does not support them. What now?

Sorry, my mistake. It should have been /usr/sbin/iptables -L

If the firewall is running you'll get an enormous amount of output. If it is
not running, you'll get about 6 lines.

//Anders

[jaakko tamminen]

Hi

The port 963 is not listed in /etc/services, so it is not a "standard"
service. (914-988 Unassigned).

If You don't have "FW_SERVICES_EXTERNAL_TCP=963" or
FW_SERVICES_TRUSTED_TCP=963" along by listing trusted hosts, that port is not
seen by the outside world.

If You want, You could trace down the program that uses the port.. Start by
doing "ps aux", which will give You a full list of running processes.. it
will be there somewhere.

I believe it is a piece of software that You have installed.

When You have located the suspicious process, search /etc/rc.d if there is a
script that starts the program.

Then do a "/etc/rc.d/<found_script> stop", that should stop the process.. Then
You should have clear picture what the service is...

Jaska.

it might come from. Please give the port number, it is not a secret!

963

[Anders Johansson]

Post by jaakko tamminen
Hi
The port 963 is not listed in /etc/services, so it is not a "standard"
service. (914-988 Unassigned).
If You don't have "FW_SERVICES_EXTERNAL_TCP=963" or
FW_SERVICES_TRUSTED_TCP=963" along by listing trusted hosts, that port is
not seen by the outside world.
If You want, You could trace down the program that uses the port.. Start by
doing "ps aux", which will give You a full list of running processes.. it
will be there somewhere.

If might be easier to do

fuser -v 963/tcp

That should give you the process id as well as the command that started the
process that uses the port

regards
Anders

[Tony White]

Post by Anders Johansson

Post by jaakko tamminen
Hi
The port 963 is not listed in /etc/services, so it is not a "standard"
service. (914-988 Unassigned).
If You don't have "FW_SERVICES_EXTERNAL_TCP=963" or
FW_SERVICES_TRUSTED_TCP=963" along by listing trusted hosts, that port is
not seen by the outside world.
If You want, You could trace down the program that uses the port.. Start by
doing "ps aux", which will give You a full list of running processes.. it
will be there somewhere.

If might be easier to do
fuser -v 963/tcp
That should give you the process id as well as the command that started the
process that uses the port

As usual, there are many ways to do the same job. I prefer

lsof -i

because you get *all* the info you need in one place:
command, PID, user, protocol, and service/port

Very useful when playing with firewalls.

Brgds,
Tony

[jaakko tamminen]

Hi

On my machine I don't get any output from the command... That is why I would
have started with "ps aux".

Jaska.

Post by Tony White
As usual, there are many ways to do the same job. I prefer
lsof -i
command, PID, user, protocol, and service/port

[Anders Johansson]

Post by jaakko tamminen
Hi
On my machine I don't get any output from the command... That is why I
would have started with "ps aux".

But what would "ps aux" give you? What do you propose, to kill processes until
the port closes?

//Anders

[jaakko tamminen]

Hi

"ps aux" would give some information for tracking down a process that might
use the port 963.

Then as said in earlier reply, try to find where that process is started, and
thus be able to stop it by it's own script if it exist.

Because the port was not stated in inetd, it must have a script somewhere.

Jaska.

Post by Anders Johansson

Post by jaakko tamminen
On my machine I don't get any output from the command... That is why I
would have started with "ps aux".

But what would "ps aux" give you? What do you propose, to kill processes
until the port closes?
//Anders

[Tony White]

Post by jaakko tamminen
Hi
On my machine I don't get any output from the command... That is why I would
have started with "ps aux".
Jaska.

Strange? *nothing* ? And it appears in <ps aux> but not <lsof -i>

That's weird!

Rgds,
Tony

Post by jaakko tamminen

Post by Tony White
As usual, there are many ways to do the same job. I prefer
lsof -i
command, PID, user, protocol, and service/port

--
Check the headers for your unsubscription address
Also check the archives at http://lists.suse.com

[jaakko tamminen]

Hi

True, no output in "lsof -i". Without the parameter I do get awful lot of
output... But now, I DO get some output, as it should be...strange!

I tried it several times, and indeed, it works 9/10 times, but sometimes no
output, it just returns to prompt.

Well, these things happens sometimes. I'll have a close look when I have the
time.

Jaska.

Post by Tony White

Post by jaakko tamminen
On my machine I don't get any output from the command... That is why I
would have started with "ps aux".

Strange? *nothing* ? And it appears in <ps aux> but not <lsof -i>
That's weird!
Rgds,
Tony

[Anders Johansson]

Post by Tony White
As usual, there are many ways to do the same job. I prefer
lsof -i
command, PID, user, protocol, and service/port

Thanks, I didn't know about that one. You learn something new every day :)

//Anders