[plug] NMAP Scan

[Anthony J. Breeds-Taurima]

On Sat, 8 Jul 2000, Earnshaw, Mike wrote:

> List, Did an nmap on my system after we where compromised this week and
> closed the ones I had left open in inetd.conf, but it also lists the
> following as being open;
> 
> 111 sunrpc

Is portmap, used for RPC calls to your system ... basically you shouldn't need
it unless you're running (or using ?) NFS.

under RedHat you'd do:
/etc/rc.d/init.d/portmap stop
chkconfig --del protmap

To tun off this service.

> 992 telnets

telent that has been SSL enabled

> 997 maitrd

no Idea

use eithe fuser or lsof to locate the proccess running this service.

> 1002 unknown

ditto

> 1024 kdm

Ummmm you're running X on a gateway ????
 
> Q: WHere are thses started so that I can disable them? Are they needed?
> And what is port 'Auth' for?

Auth is identd.  It will tell a querying Sysytem the uname that a service is
running under.  You can use nmap -I to see it in effect.  You'll get serveral
opinions about it's usefullness and security implications.


Yours Tony.

/*
 * "The significant problems we face cannot be solved at the 
 * same level of thinking we were at when we created them."
 * --Albert Einstein
 */