Getting to know your network services By V. Navratilova Special to the Tribune March 23, 2000 Not knowing what network services are open on your Linux machine is like not knowing which doors and windows in your house don't have locks. Like a ground-floor window, every network service is a potential portal for burglars or crackers to crawl through, so you should at least know where your ground floor windows are located, even if you only have a screen on them with no lock. Network services attach themselves to virtual entities called ports. They are conceptually similar to the serial and printer ports in the back of your machine because they allow data to pass through, but these ports reside in the networking software. There are 65,535 network ports. Ports 1 through 1024 are called privileged ports because only processes running as the superuser are allowed to connect to them. Another distinguishing characteristic of these ports is each is assigned to a specific protocol, such as ftp or telnet. A list of the services mapped to each port usually is found in the /etc/services file in Linux (see Figure 1). The Internet "super-server" inetd is a daemon started at boot time that will begin most of your garden-variety network processes. When a network request comes in on a port, inetd will decide which service corresponds to that port and it will start a service to take care of the request. Pruning the list of network services started at this point is a big step in making your machine more secure because many unnecessary services often are turned on by default. Start pruning by looking in /etc/inetd.conf, the file inetd reads to determine the ports to which it should listen for incoming traffic. Comment out any service you don't use by putting a # at the beginning of its line to prevent inetd from starting it at boot time. (Hint: If you can't tell what a service does, look at its man page. In general turn off everything that you don't recognize.) The network resources you need to keep running will depend on your network situation, but a typical configuration is to take out everything other than ssh, telnet, ftp and auth (identd). Of course, if you don't telnet, ssh or ftp into your own machine, you should comment out those as well. There are some network services that are not launched by inetd but still begin at boot time, such as portmapd or rpc.portmap, mountd, quotad, nfsd, rpc.bind and sendmail. Check if these processes are running by looking through your process listing (ps ax) or by using netstat for a list of the ports to which Linux is listening at the present time. netstat -a will give you a listing of all your open ports (see Figure 2). Pay attention to the first section of the output for ports that are listed as LISTENing. These ports have network services actively running. Again, if you don't need those services, you should shut them down. To shut down services that start at boot outside of inetd, look through the rc scripts and comment out the ones you don't need. Since each Linux distribution sets up its rc scripts differently, I can't give you specific instructions on how to find where these services are started. Generally you can go to your /etc/rc.d directory, and grep through the directory tree. Comment out the services you don't want started at boot time. Another way to assess your network openings is to look at your Linux installation from the outside -- in other words, from the network. Do this by using a port scanner such as nmap to scan your own machine. A port scanner usually will connect to every privileged port and record any response it receives, but it can also be configured to scan all ports, or just udp or tcp ports. The responses it gets from the connections are then analyzed and presented as a short report on what's running. You'll want to rely on netstat for your regular network services view because a thorough port scan, including udp ports, sometimes can take up to 10 minutes. However, the average port scan of privileged ports will take only a few seconds. nmap is a great port scanner because it has algorithms for different kinds of scans, and it will even try to guess which operating system the scanned computer is running. nmap was written to scan large networks, and it is superior to the previous generation of Linux network scanners because of its scanning flexibility. Figure 3 shows a sample nmap output. (Warning: Do not take the liberty of scanning your friends' machines without their permission. In many circles doing an uninvited portscan is considered a precursor to a hacking attempt.) Now that you've given your system a good scrub-down, reboot your machine and look through your process listing and netstat output again to see if there are any stubborn network services running that you don't need. Track down where the processes were intitiated and comment them out, then reboot and check again. Locking down your network services is a prerequisite to good site security, so do it regularly between upgrades and after every fresh Linux install. V. Navratilova, a network security analyst for Tribune Information Systems and a long-time Linux user, can be reached at [email protected].