nixCraft
Linux / UNIX Tech Support Forum
Avoiding nmap service and application version detecion
This is a discussion on Avoiding nmap service and application version detecion within the Networking, Firewalls and Security forums, part of the Mastering Servers category; Is there a way to avoid nmap service and application version detection? I scanned my server with nmap and this ...
|
|||||||
| Networking, Firewalls and Security No it's not a secret. Talk about firewalls and security issues. |
 |
|
|
LinkBack | Thread Tools | Display Modes |
12-05-2009, 08:22 PM
|
|||
|
|||
Avoiding nmap service and application version detecion
Is there a way to avoid nmap service and application version detection? I scanned my server with nmap and this is the output:
Code:
Interesting ports on 192.168.15.4: Not shown: 1709 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.5 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) 80/tcp open http Apache httpd 2.2.3 ((CentOS)) |_ HTML title: Apache HTTP Server Test Page powered by CentOS 111/tcp open rpcbind | rpcinfo: | 100000 2 111/udp rpcbind | 100024 1 793/udp status | 100000 2 111/tcp rpcbind |_ 100024 1 796/tcp status 796/tcp open rpcbind |_ rpcinfo: 3128/tcp open http-proxy Squid webproxy 2.6.STABLE21 Device type: general purpose Running: Linux 2.6.X OS details: Linux 2.6.17 - 2.6.21, Linux 2.6.23 I use CentOS 5.3 Last edited by Cyborg_sa; 13-05-2009 at 08:48 AM. 
|
| Sponsored Links | ||
|
|
|
13-05-2009, 12:36 AM
|
||||
|
||||
|
Yes, it can help. See basic getting started tutorial:
__________________
Vivek Gite Linux Evangelist  Be proud RHEL user, and let the world know about your enterprise choices! Join RedHat user group. Always use CODE tags for posting system output and commands! Do you run a Linux? Let's face it, you need help
|
|
13-05-2009, 11:43 AM
|
|||
|
|||
|
I tried ur getting started tutorial but psad is not picking up anything and that output I coded in my 1st post still comes out using nmap. Again I googled around and found that SELinux may be blocking some part of psad.
Code:
http://wiki.rivalug.org/index.php/Centos5#creating_policy_example:_psad Code:
[root@cybertron Saad]# /usr/sbin/psad -S
[+] psadwatchd (pid: 3787) %CPU: 0.0 %MEM: 0.0
Running since: Wed May 13 12:00:14 2009
[+] psad (pid: 3785) %CPU: 0.0 %MEM: 1.0
Running since: Wed May 13 12:00:14 2009
Command line arguments: [none specified]
Alert email address(es): root@localhost
[+] Version: psad v2.1.5
[+] Top 50 signature matches:
[NONE]
[+] Top 25 attackers:
[NONE]
[+] Top 20 scanned ports:
[NONE]
[+] iptables log prefix counters:
[NONE]
Total packet counters: tcp: 0, udp: 0, icmp: 0
[+] IP Status Detail:
[NONE]
Total scan sources: 0
Total scan destinations: 0
[+] These results are available in: /var/log/psad/status.out
|
|
13-05-2009, 04:40 PM
|
||||
|
||||
|
Did you added the iptables LOG rules to your iptables script?
$IPT -A INPUT -j LOG $IPT -A FORWARD -j LOG
__________________
Vivek Gite Linux Evangelist Be proud RHEL user, and let the world know about your enterprise choices! Join RedHat user group. Always use CODE tags for posting system output and commands! Do you run a Linux? Let's face it, you need help
|
|
13-05-2009, 06:41 PM
|
||||
|
||||
|
You do need a properly configured firewall along with log rules. Without a firewall it won't work.
__________________
Vivek Gite Linux Evangelist Be proud RHEL user, and let the world know about your enterprise choices! Join RedHat user group. Always use CODE tags for posting system output and commands! Do you run a Linux? Let's face it, you need help
|
|
14-05-2009, 11:29 PM
|
|||
|
|||
|
I referred the book in ur tutorial and used the book's rules set with slight changes according to my network. I have only 1 NIC. This is the nmap output was:
Code:
Starting Nmap 4.68 ( http://nmap.org ) at 2009-05-14 22:01 West Asia Standard Time
Initiating ARP Ping Scan at 22:01
Scanning 192.168.15.4 [1 port]
Completed ARP Ping Scan at 22:01, 0.16s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:01
Completed Parallel DNS resolution of 1 host. at 22:01, 0.09s elapsed
Initiating SYN Stealth Scan at 22:01
Scanning 192.168.15.4 [1715 ports]
Discovered open port 22/tcp on 192.168.15.4
Discovered open port 80/tcp on 192.168.15.4
SYN Stealth Scan Timing: About 40.99% done; ETC: 22:02 (0:00:43 remaining)
Increasing send delay for 192.168.15.4 from 0 to 5 due to 11 out of 13 dropped probes since last increase.
SYN Stealth Scan Timing: About 54.23% done; ETC: 22:03 (0:01:03 remaining)
Increasing send delay for 192.168.15.4 from 5 to 10 due to 11 out of 12 dropped probes since last increase.
SYN Stealth Scan Timing: About 70.85% done; ETC: 22:04 (0:00:57 remaining)
Completed SYN Stealth Scan at 22:05, 245.52s elapsed (1715 total ports)
Initiating Service scan at 22:05
Scanning 2 services on 192.168.15.4
Completed Service scan at 22:05, 5.01s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.15.4
SCRIPT ENGINE: Initiating script scanning.
Initiating SCRIPT ENGINE at 22:05
Completed SCRIPT ENGINE at 22:05, 3.03s elapsed
Host 192.168.15.4 appears to be up ... good.
Interesting ports on 192.168.15.4:
Not shown: 1713 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh?
80/tcp open http?
|_ HTML title: Apache HTTP Server Test Page powered by CentOS
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|general purpose
Running: Captor embedded, QNX 4.X
OS details: Captor Omni-Clock (employee timeclock), QNX 4.24
Network Distance: 1 hop
Read data files from: C:\Program Files\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 257.174 seconds
Raw packets sent: 3551 (159.250KB) | Rcvd: 5 (226B)
Code:
# Generated by iptables-save v1.3.5 on Thu May 14 22:30:48 2009 *nat :PREROUTING ACCEPT [4:388] :POSTROUTING ACCEPT [9:608] :OUTPUT ACCEPT [49:3008] COMMIT # Completed on Thu May 14 22:30:48 2009 # Generated by iptables-save v1.3.5 on Thu May 14 22:30:48 2009 *filter :INPUT DROP [1:236] :FORWARD DROP [0:0] :OUTPUT DROP [16:960] -A INPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options -A INPUT -m state --state INVALID -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -s ! 192.168.15.0/255.255.255.0 -i eth0 -j LOG --log-prefix "SPOOFED PKT " -A INPUT -s ! 192.168.15.0/255.255.255.0 -i eth0 -j DROP -A INPUT -s 192.168.15.0/255.255.255.0 -i eth0 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A INPUT -s 192.168.15.0/255.255.255.0 -i eth0 -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -i ! lo -j LOG --log-prefix "DROP " --log-tcp-options --log-ip-options -A OUTPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options -A OUTPUT -m state --state INVALID -j DROP -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 43 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 4321 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -j LOG -A OUTPUT -o ! lo -j LOG --log-prefix "DROP " --log-tcp-options --log-ip-options COMMIT # Completed on Thu May 14 22:30:48 2009 Then I tried ur script and again initiated intense scan using namp and the output was: Code:
Starting Nmap 4.68 ( http://nmap.org ) at 2009-05-14 22:36 West Asia Standard Time
Initiating ARP Ping Scan at 22:36
Scanning 192.168.15.4 [1 port]
Completed ARP Ping Scan at 22:36, 0.16s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:36
Completed Parallel DNS resolution of 1 host. at 22:36, 0.09s elapsed
Initiating SYN Stealth Scan at 22:36
Scanning 192.168.15.4 [1715 ports]
Discovered open port 22/tcp on 192.168.15.4
Completed SYN Stealth Scan at 22:36, 11.59s elapsed (1715 total ports)
Initiating Service scan at 22:36
Scanning 1 service on 192.168.15.4
Completed Service scan at 22:36, 5.01s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 192.168.15.4
SCRIPT ENGINE: Initiating script scanning.
Initiating SCRIPT ENGINE at 22:36
Completed SCRIPT ENGINE at 22:37, 51.04s elapsed
Host 192.168.15.4 appears to be up ... good.
Interesting ports on 192.168.15.4:
Not shown: 1714 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|general purpose
Running: Captor embedded, QNX 4.X
OS details: Captor Omni-Clock (employee timeclock), QNX 4.24
Network Distance: 1 hop
Read data files from: C:\Program Files\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 71.273 seconds
Raw packets sent: 3504 (157.182KB) | Rcvd: 3 (160B)
Can you tell me where in my given rules set should I do what changes so that legitimate connections such as SSH are not blocked. Also do you have a tutorial on iptables?
|
|
| Tags |
| linux , networking , nmap , security |
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) |
|
| Thread Tools | |
| Display Modes | |
Linear Mode
|
|
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Linux Firewall IPTABLES Block nmap scanning | jee | Networking, Firewalls and Security | 2 | 24-09-2008 11:51 PM |
| nmap pings | capibolso | Linux software | 1 | 09-09-2008 01:23 AM |
| Registering an application as a service on linux | verruckt | Getting started tutorials | 2 | 01-08-2007 06:48 PM |
| application usage | zafar466 | Web servers | 1 | 31-03-2007 12:01 AM |
| nmap howto and examples | sgmsara | Linux software | 2 | 12-02-2007 07:59 PM |
All times are GMT +5.5. The time now is 07:10 AM.
