What ports should be stealthed?

flashingcurser · August 15th, 2002, 12:06 AM

Im learning iptables and have come up with a basic script that stealths ports (though its really crude lol)
The ports I have taken care of so far are (basically all the ones at shields up):
21
23
25
79
110
113
135
139
143
443
445
5000

The question is what others need to be stealthed?

Might be the wrong forum for this---regardless. Thanks guys

**GroundZero3** · August 15th, 2002, 12:16 AM

http://info-x.co.uk/default.asp?page...info/ports.stm

here is a list of ports and what there used for

August 15th, 2002, 12:21 AM

Sygate offers a series of port scans for you and tell you the status of all your ports. Works for me with Smoothwall!

http://scan.sygatetech.com/

Cheers
Mick

flashingcurser · August 15th, 2002, 01:10 AM

Wow that was fast! Thanks guys going there as I type

flashingcurser · August 15th, 2002, 01:19 AM

GroundZero I'm book marking that for life!

Mick, sygate's scan found my browser (galeon) and found I have SSH running. Is this a problem?

Again thanks

August 15th, 2002, 01:40 AM

It found my browser as well through my smoothwall box. Dunno if this is as issue; it still finds it when I have SPF on full, so I doubt a firewall can stop it. I think your browser sends stuff to identify itself to websites. Unless you don't connect to the web with a browser, I think it can be detected easily.

Cheers
Mick

ClubMed · August 15th, 2002, 06:45 AM

Nice link GZ3

nodnerb2 · August 15th, 2002, 07:36 AM

Hi,

Mickwish I tried your link and I get an error message when I try for the scan.

It reads: http://scan.sygate.com:443/cgi-bin/probe/quickscan....

Access to this port is disabled for security reasons

Any ideas wht this is?

Cheers

Nodnerb2

alligator_al · August 15th, 2002, 08:34 AM

Mickwish -- you are correct to point out that browser and OS can be identified over the web. It isn't really an issue (for me, anyway) but can be blocked using something like Sygate PF Pro, which has a 'stealth browsing' option. However, some sites will just refuse to work in this mode, and others may show unexpected results.
(and I'm not sure it's enough to justify the cost of SPF pro...)

nodnerb2 -- is the error message over the web, or is it a dialog box? (the link doesn't work, but I suppose it isn't meant to be a link)

nodnerb2 · August 15th, 2002, 09:49 AM

Hi,

It is a little dialog box. The http address is along the top strip.

Cheers

Nodnerb2