port 389

port 389

[Rakotomandimby Mihamina]

Hello , 
I asked for some frineds of mine to scan mly host , and they all find my 389 
port opened . here is the report , for those who understand french : 
http://www.tsenagasy.com/forum/viewtopic.php?p=33992#33992

i dont understand what's happening :

netstat | grep 389 
gives nothing , and
this is my set of rules .
would you help me to see , what is wrong ? or is the 389 just an "answer" 
port ?


iptables -P INPUT DROP
iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s 
-j ACCEPT
iptables -A INPUT -i ppp0 -m unclean -j LOG --log-level debug --log-prefix 
"unclean_: "
iptables -A INPUT -i ppp0 -m unclean -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 8090 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 10080 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --syn -m limit --limit 10/s -j LOG --log-level debug 
--log-prefix "syn_flood_attack_: "
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 10/s 
-j LOG --log-level debug --log-prefix "port_scan_attack_: "
iptables -A INPUT -j LOG --log-level debug --log-prefix "dropped_input_: "

-- 
Rakotomandimby Mihamina Andrianifaharana
Tel : +33 2 38 76 43 65
http://stko.dyndns.info/site_principal/Members/mihamina

Re: port 389

[Antony Stone]

On Friday 23 January 2004 7:27 am, Rakotomandimby Mihamina wrote:

> Hello ,
> I asked for some frineds of mine to scan mly host , and they all find my
> 389 port opened . here is the report , for those who understand french :
> http://www.tsenagasy.com/forum/viewtopic.php?p=33992#33992
>
> i dont understand what's happening :
>
> netstat | grep 389
> gives nothing , and
> this is my set of rules .
> would you help me to see , what is wrong ? or is the 389 just an "answer"
> port ?

TCP port 389 is used for LDAP.

(There is no such thing as an "answer" port.   Services answer from whatever 
port they listen on.)

I suspect your ISP has some sort of transparent authentication proxy server 
set up and that it is this which your friends are finding.

Regards,

Antony.

-- 
I want to build a machine that will be proud of me.

 - Danny Hillis, creator of The Connection Machine

                                                     Please reply to the list;
                                                           please don't CC me.

Re: port 389

[Rakotomandimby Mihamina]

On Friday 23 January 2004 09:38, Antony Stone wrote:
> TCP port 389 is used for LDAP.

i knew it with a "grep 389 /etc/services"

> (There is no such thing as an "answer" port.   Services answer from
> whatever port they listen on.)

uh ! that's the proof i still need to learn about networking ...
 
> I suspect your ISP has some sort of transparent authentication proxy server
> set up and that it is this which your friends are finding.

Uh ? well . let's hope it is not a backdoor :-) 
( on my PC )

> Regards,

Thanks
> Antony.

-- 
Rakotomandimby Mihamina Andrianifaharana
Tel : +33 2 38 76 43 65
http://stko.dyndns.info/site_principal/Members/mihamina

Re: port 389

[Arnt Karlsen]

On Fri, 23 Jan 2004 13:36:07 +0100, 
Rakotomandimby Mihamina <mrakotom@free.fr> wrote in message 
<200401231336.07836.mrakotom@free.fr>:

> On Friday 23 January 2004 09:38, Antony Stone wrote:
> > TCP port 389 is used for LDAP.
> 
> i knew it with a "grep 389 /etc/services"
> 
> > (There is no such thing as an "answer" port.   Services answer from
> > whatever port they listen on.)
> 
> uh ! that's the proof i still need to learn about networking ...
>  
> > I suspect your ISP has some sort of transparent authentication proxy
> > server set up and that it is this which your friends are finding.
> 
> Uh ? well . let's hope it is not a backdoor :-) 
> ( on my PC )

..play more, say 'netstat -tulepan ',  nmap, nessus etc., if 
for nothing else, you may find new tools you like better.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.