making services invisible

making services invisible

[Julio Cesar Ody]

Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I 
blocked external acess to some services using the following rule:

iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port 
<port1>,<port2>,<blablabla> -j REJECT

However, when I perform a stealth scan using nmap on my host, I still 
can see them running, but instead of "opened" I get them as "filtered". 
Is there a way to block these results, making the services literally 
invisible ? Appreciate any help, and also any technical information 
(links, docs) regarding the answer.



Julio Cesar Ody

Re: making services invisible

[Ryan Daly]

[-- Attachment #1: Type: text/plain, Size: 879 bytes --]

Use DROP instead of REJECT.

REJECT action tells tables to send back an ICMP message indicating that
you're REJECTing the packet.  DROPing will just DROP with no further
action.

--

On Thu, 2002-10-10 at 09:13, Julio Cesar Ody wrote:

    Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I 
    blocked external acess to some services using the following rule:
    
    iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port 
    <port1>,<port2>,<blablabla> -j REJECT
    
    However, when I perform a stealth scan using nmap on my host, I still 
    can see them running, but instead of "opened" I get them as "filtered". 
    Is there a way to block these results, making the services literally 
    invisible ? Appreciate any help, and also any technical information 
    (links, docs) regarding the answer.
    
    
    
    Julio Cesar Ody

[-- Attachment #2: Type: text/html, Size: 2035 bytes --]

Re: making services invisible

[Eric Leblond]

On Thu, 2002-10-10 at 15:13, Julio Cesar Ody wrote:
> Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I 
> blocked external acess to some services using the following rule:
> 
> iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port 
> <port1>,<port2>,<blablabla> -j REJECT

Use DROP not REJECT, with REJECT you send an ICMP message, so it's
filtered, not close

-- 
Éric Leblond
courriel : eleblond@init-sys.com

Re: making services invisible

[Kevin Dwyer]

On Thu, 10 Oct 2002, Julio Cesar Ody transmitted the following:

> Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I
> blocked external acess to some services using the following rule:
>
> iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port
> <port1>,<port2>,<blablabla> -j REJECT
>
> However, when I perform a stealth scan using nmap on my host, I still
> can see them running, but instead of "opened" I get them as "filtered".
> Is there a way to block these results, making the services literally
> invisible ? Appreciate any help, and also any technical information
> (links, docs) regarding the answer.

You need to reply with an RST.

Something like: --reject-with tcp-reset


/* Kevin Dwyer                                Allegiance Internet */
/* network security engineer                   Commerce Center II */
/* email: Kevin.Dwyer@algx.net                7601 Ora Glen Drive */
/* phone: 240-616-2075                        Greenbelt, MD 20770 */
/*      >++++++++++[<++++++++++>-]<.+++++.----.[-]++++++++++.     */

Re: making services invisible

[Leonardo Rodrigues ( listas )]

    DROP would make nmap ( or any other scanner ) mark that port as filtered
too. To make services closed and 'invisible' to scanners, you should use '-j
REJECT --reject-with tcp-reset'.

    Sincerily,
    Leonardo Rodrigues

----- Original Message -----
From: "Eric Leblond" <eleblond@init-sys.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, October 10, 2002 10:46 AM
Subject: Re: making services invisible


On Thu, 2002-10-10 at 15:13, Julio Cesar Ody wrote:
> Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I
> blocked external acess to some services using the following rule:
>
> iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port
> <port1>,<port2>,<blablabla> -j REJECT

Use DROP not REJECT, with REJECT you send an ICMP message, so it's
filtered, not close

Re: making services invisible

[Nick Drage]

On Thu, Oct 10, 2002 at 11:41:32AM -0300, Leonardo Rodrigues ( listas ) wrote:
> 
>     DROP would make nmap ( or any other scanner ) mark that port as filtered
> too. To make services closed and 'invisible' to scanners, you should use '-j
> REJECT --reject-with tcp-reset'.

Spot on :)

Isn't this one in an FAQ somewhere by now, seeing as no-one ever reads the
rather good nmap man page.

I haven't checked but last time I looked the TTL will be different with RSTs
sent from iptables rather than those sent because there's no listener on the
port.  There are ways around this too, depends how invisible you want to
be...

-- 
FunkyJesus System Administration Team

How will stop follwoing service

[Sundaram Ramasamy]

Hi,

I am running Redhat Linux, How will I stop following process. I checked in
chkconfig and /etc/xinetd. directory, I don't get any information.

111/tcp    open        sunrpc
1024/tcp   open        kdm
1025/tcp   open        listen

Thanks
Sundaram