Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-30 Thread Johann Spies
On Mon, Aug 29, 2011 at 02:46:52PM +0200, yudi v wrote: Probably portmap... See if it's installed $ dpkg --get-selections portmap If it is, and it bothers you, it can be removed - check and see if anything uses it:- # apt-get -s remove portmap | less

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-29 Thread yudi v
The following packages will be REMOVED: cifs-utils libnfsidmap2 nfs-common nfs-kernel-server samba samba-common samba-common-bin samba-doc smbclient smbfs swat winbind 0 upgraded, 0 newly installed, 12 to remove and 4 not upgraded. Remv smbfs [2:4.5-2] Remv cifs-utils [2:4.5-2] Remv

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-29 Thread Scott Ferguson
On 29/08/11 18:35, yudi v wrote: snipped I purged the above files but still have� the following service running. 111/tcp open� rpcbind -- Kind regards, Yudi Probably portmap... See if it's installed $ dpkg --get-selections portmap If it is, and it bothers you, it can be removed -

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-29 Thread yudi v
Probably portmap... See if it's installed $ dpkg --get-selections portmap If it is, and it bothers you, it can be removed - check and see if anything uses it:- # apt-get -s remove portmap | less If it's the only package to be removed:- # apt-get --purge remove portmap Check your

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-28 Thread yudi v
I use postpaid mobile broadband and my IP is both the system address and the gateway. There is no NAT with postpaid service, it's only available with prepaid in Australia. Not sure why. Not sure what you mean there I suspect you mean only postpaid allow a static IP address (for some

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-28 Thread Scott Ferguson
On 28/08/11 18:37, yudi v wrote: snipped my system IP for ppp0 is 101.***.***.*** and it's not static. but from what I can remember all postpaid accounts in Australia have 10.***.***.*** addresses and are behind NAT. I've yet to see any (non-SLA business class) USB UMTS modems by any

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-28 Thread yudi v
http://myip.dk/ will give you the remote access address. Just ssh to the displayed address. I'd suggest you try - it's easier than just believing everything you read on whirlpool. The signal to noise ratio there can be bad. Exetel have good tech support - Vodaphail don't even know where their

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-28 Thread yudi v
# apt-get --purge remove libnfsidmap2 nfs-common samba if you don't use samba at all (cifs-utils samba samba-common samba-common-bin smbfs) then change samba to samba* I'd suggest using -s instead of --purge first - just in case samba was originally pulled in by another package which you

securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread yudi v
Nmap suggests the following ports are open: 25/tcp open smtp 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 631/tcp open ipp 901/tcp open samba-swat 2049/tcp open nfs I run a desktop email client that uses smtp apart from that I do not know why rest of the

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Brad Alexander
Ports 139, 445 and 901 are samba running. Port 631 is cups, your printer driver. 111 and 2049 are for NFS. If you don't need them, you should be able to turn them off...If you do need it, then you should be able to firewall it, using iptables to limit access to the hosts or subnets you need. On

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Joe
On Sun, 28 Aug 2011 01:05:47 +1000 yudi v yudi@gmail.com wrote: Nmap suggests the following ports are open: 25/tcp open smtp 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 631/tcp open ipp 901/tcp open samba-swat 2049/tcp open nfs I run a

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Chris Brennan
On 8/27/2011 11:38 AM, Brad Alexander wrote: Ports 139, 445 and 901 are samba running. Port 631 is cups, your printer driver. 111 and 2049 are for NFS. If you don't need them, you should be able to turn them off...If you do need it, then you should be able to firewall it, using iptables to

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Brian
On Sun 28 Aug 2011 at 01:05:47 +1000, yudi v wrote: Nmap suggests the following ports are open: 25/tcp open smtp 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 631/tcp open ipp 901/tcp open samba-swat 2049/tcp open nfs I run a desktop email

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Brian
On Sat 27 Aug 2011 at 17:16:16 +0100, Joe wrote: On Sun, 28 Aug 2011 01:05:47 +1000 yudi v yudi@gmail.com wrote: how can I find out if this system has been compromised? You can try chkrootkit and rkhunter, but the latter at least works A natural history expedition searching for

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Gilbert Sullivan
On 08/27/2011 02:43 PM, Brian wrote: A natural history expedition searching for unicorns and dodos would have as much success as these two programs are likely to have. I was once on a natural history expedition. We found no unicorns, but we did find dodos. We weren't looking for them, but

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Ralf Jung
Hi, ipp is CUPS, the network printing server, and you know whether you need that. Now that you mention it... I also see cups listening on all devices: $ sudo netstat -nlp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Aniruddha
On Sat, Aug 27, 2011 at 5:05 PM, yudi v yudi@gmail.com wrote: Nmap suggests the following ports are open: 25/tcp open smtp 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 631/tcp open ipp 901/tcp open samba-swat 2049/tcp open nfs Which nmap

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread yudi v
Just to clarify my post. This is a new install and I was a bit careless while installing. It has no data on it. I was more concerned with LUKS+LVM working at install. I did not realize I selected to install SSH, I do not use Samba or NFS not sure how those got installed. Again it might have been

Re: securing the system, stopping unnecessary services and closing open ports.

2011-08-27 Thread Scott Ferguson
On 28/08/11 11:39, yudi v wrote: Just to clarify my post. This is a new install and I was a bit careless while installing. It has no data on it. I was more concerned with LUKS+LVM working at install. I did not realize I selected to install SSH, I do not use Samba or NFS not sure how those got