Subject: scan host installed fwtk

From: wen <[email-masked]>
Date: Thu, 20 Jul 2000 13:15:26 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi:
				|  internet
				|
				|
                      --------------------------
                          system box

		      --------------------------
				|
				|
				| intranet

in my system box, I have installed fwtk2.1 and redhat6.1.

now by portscan tool I scan system box from internet and find some port which is opened ,for example,21,23,80,513,etc.  when someone scan my system box, in order to make him not to find opened port how to  do?  please give me some advice.

thanks

            wen

---

From: Ted Keller <[email-masked]>
Date: Thu, 20 Jul 2000 08:21:17 -0400 (EDT)

Wen,

Port 21 - ftp command port.  That is openend up by the ftp-gw program.
Make sure you have your netperm table set appropriately.

port 23 - telnet - tn-gw.  ditto above

port 80 - http - you need that for your web server on your DMZ

port 513 - login ???  are you running the rlogin proxy?  You may want to
kill that on off.

There were (a couple of year ago) listed some patches to the tool kit
which allow you to bind to a port.  If implmented, you could bind the
proxies to internal ports - hence hiding some of the external visability.

(September, 1998....)

ted keller

---

From: Michel Bardiaux <[email-masked]>
Date: Wed, 26 Jul 2000 15:57:24 +0200

>                                 |  internet

You have to specify in netperm-table that only addresses on your
intranet are allowed access to the proxies. I do that with netacl, but
maybe there are other ways? Beside that minimum, you may take a
'belt-and-suspenders' approach, and configure your hosts.allow and
hosts.deny files (see "man 5 hosts_access"), and install ipfwadm or
ipchains too.

-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10