Linux System Security Management: viewing and tracking open ports and services

View the ports opened in the system and disable unnecessary ports and programs. The procedure is as follows: 1. view the ports opened externally: [root @ mail ~] # Nmap127.0.0.1 # Note: this should be changed to public network ipStartingNmap4.11 (http: www. insecure. orgnmap) at2010-04-2011: 06 CSTInterestingportson

View the ports opened in the system and disable unnecessary ports and programs. The procedure is as follows:

1. view the opened ports:

[Root @ mail ~] # Nmap 127.0.0.1 # Note: The public ip address should be changed here

Starting Nmap 4.11 (http://www.insecure.org/nmap/) at 2010-04-20 CST

Interesting ports on 127.0.0.1

Not shown: 1668 closEdPorts

PORT STATE SERVICE

22/tCpOpen ssh

25/tcp open smtp

80/tcp open http

1010/tcp open unknown

2. Visit unknown ports

[Root @ mail ~] # NetStat-Anlp |Grep 1010

Tcp 0 0 0.0.0.0: 1010 0.0.0.0: * LISTEN3796/Rpc. statd

#

# [Root @ mail ~] #LsOf-p 3796

#

#

[Root @ mail init. d] #WhichRpc. statd

/Sbin/rpc. statd

[Root @ mail ~] # Rpm-qf/sbin/rpc. statd

Nfs-utils-1.0.9-40.el5

[Root @ mail init. d] # ll/etc/init. d/nfs *

-Rwxr-xr-x 1 root 4668 Jan 21 2009/etc/init. d/nfs

-Rwxr-xr-x 1 root 3465 Jan 21 2009/etc/init. d/nfslock

[Root @ mail init. d] # service nfs status

Rpc. mountd is stopped

Nfsd is stopped

Rpc. rQuotaD is stopped

[Root @ mail ~] #/Etc/init. d/nfslock status

Rpc. statd (pId 3796) Is running...

3. Disable irrelevant applications

[Root @ mail init. d] # service nfslock

Usage:/etc/init. d/nfslock {start | stop | status | restart | probe | condrestart}

[Root @ mail init. d] # service nfslock stop

StopPingNFS statd: [OK]

4. Disable irrelevant services

[Root @ mail init. d] #Chkconfig-- Level 345 nfslock off

5. basically install centos. These services are generally unavailable:

Chkconfig -- level 2345 maid off # hpiod, hpssd, related to printing devices

Chkconfig -- level 2345 nfslock off # nfs

Chkconfig -- level 2345 avahi-daemon off # devices and services involving zeroconf

Chkconfig -- level 2345 cups off # printing involved

Chkconfig -- level 2345 portmap off # nfs