-
Need help securing box
Hi all,
I have nmap'd myself and ps -A and I shall post below my results. First of all can you please identify which of the ps -A results i need to kill in order to turn off all of the services that nmap detected. Also do you recommened that i kill any of the other processes that im runnning? I would deffinately like to kill ssh rpcbind and the netbios-ssn processes. Thanks a lot :-)
Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2005-01-28 18:37 GMT
Interesting ports on myBox (127.0.0.1):
(The 1655 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.6.1p2 (protocol 1.99)
111/tcp open rpcbind 2 (rpc #100000)
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux Kernel 2.4.0 - 2.5.20
Uptime 0.044 days (since Fri Jan 28 17:34:10 2005)
PID TTY TIME CMD
1 ? 00:00:04 init
2 ? 00:00:00 keventd
3 ? 00:00:00 ksoftirqd_CPU0
4 ? 00:00:00 kswapd
5 ? 00:00:00 bdflush
6 ? 00:00:00 kupdated
45 ? 00:00:00 kapmd
49 ? 00:00:00 khubd
100 ? 00:00:00 usb-storage-0
101 ? 00:00:00 scsi_eh_1
168 ? 00:00:00 portmap
177 ? 00:00:00 usb-storage-1
178 ? 00:00:00 scsi_eh_2
274 ? 00:00:00 syslogd
301 ? 00:00:00 klogd
326 ? 00:00:00 cardmgr
338 ? 00:00:00 inetd
342 ? 00:00:00 nmbd
344 ? 00:00:00 smbd
351 ? 00:00:00 sshd
358 ? 00:00:00 atd
361 ? 00:00:00 cron
366 ? 00:00:00 kdm
369 ? 00:00:14 X
370 tty1 00:00:00 getty
371 tty2 00:00:00 getty
372 tty3 00:00:00 getty
373 tty4 00:00:00 getty
374 tty5 00:00:00 getty
375 tty6 00:00:00 getty
376 ? 00:00:00 kdm
416 ? 00:00:00 kde3
443 ? 00:00:00 ssh-agent
453 ? 00:00:00 kdeinit
456 ? 00:00:00 kdeinit
459 ? 00:00:00 kdeinit
461 ? 00:00:08 kdeinit
475 ? 00:00:00 kdeinit
477 ? 00:00:00 kdeinit
486 ? 00:00:00 kdeinit
487 ? 00:00:00 kwrapper
489 ? 00:00:00 kdeinit
490 ? 00:00:00 kdeinit
492 ? 00:00:01 kdeinit
494 ? 00:00:01 kdeinit
495 ? 00:00:00 kdeinit
498 ? 00:00:01 kdeinit
503 ? 00:00:00 kdeinit
504 pts/0 00:00:00 bash
581 pts/0 00:00:00 bash
598 ? 00:00:07 opera
601 ? 00:00:00 opera
618 ? 00:00:00 kdeinit
620 ? 00:00:00 kdeinit
622 pts/0 00:00:00 ps
-
The kde* items are for remote XWindows sessions. I've never run X on a server, so I'd have no idea what to kill for that.
nmbd and smbd are for Samba you can kill them by turning off smb.
Have you considering setting up iptables (firewall) for security?