Turning off ports 80, 443 and 137-139

[dictum9]

I need to turn off these ports -
80 (http)
443 (shttp)
137,138,139 (NetBios)

This is on HP-UX 11iv2. How do I do that, is it enough to edit /etc/services and comment them out or is something else involved?

[Steven E. Protter]

Shalom etc, nice itrc handle....

/etc/services is like a reservation file. Merely removing the entries is a good start but it doesn't protect your system. Oracle operates on port 1521 and others with no entry at all in the /etc/services file.

Bill Hassell has a great explanation of what /etc/services really is. I'm telling you though that changing it does not protect your system.

I firewall can protect your system blocking the ports above. IPfileter is an example of that.

In general people don't use IPFILTER, they use a third party firewall product or block the traffic on a router.

SEP

[dictum9]

Hi Steven,

So in a nutshell you are saying that there is nothing I can do on the system to disable these ports and that it is a firewall issue?

I realize that ports 137-139 are NetBios and it can activate them without the /etc/services file.

[Mike Keighley]

When you say "I need to turn off these ports" I am not entirely clear whether you just want to stop the process that is currently running on that port (in which case netstat -a or lsof might point you in the right direction), or whether you want to ensure that no process can EVER bind to that port (in which case please recall that stopping root doing something is nigh impossible).

I think what Steven is trying to stress is that /etc/services (which you mentioned in your original post) has little or nothing to do with the question of what service is running on a given port.

After all, a process running as root can bind any low-numbered port it wants, and serve up any service it sees fit. You can have telnetd on port 80 if you are perverse enough to want it !

Unless it has changed since 11.0, /var/adm/inetd.sec may be of more to you, as it controls what remote machines may access each service/port. You could deny all hosts to port 80 etc., or all except 127.0.0.1

As well as that, you would be well advised to simply not start any unwanted services.
netstat -a will confirm what ports have listeners on them. Finding the daemon that has opened that port to listen is less trivial, however.

Most daemons are started from scripts in /sbin/init.d/ at startup time, based on configuration settings in the parameter files in /etc/rc.config.d

If the daemon doesn't start, the port could be considered "turned off". At least it will not respond to a port scanner, which may be all you want ?

[Geoff Wild]

As long as the web services are not enabled - then the port is considered off.

To drop packets - you need a firewall - ipfilter does the work nicely on HP-UX:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B9901AA

Rgds...Geoff

[Rick Garland]

Not running the services will keep the ports off. Example, ports 80 & 443 are typically http & https respectively.
If you don't start http services (e.g., apache) then these pports will not be in use.

To check, look at the utility 'nmap' available from the gatekeep.cs.utah.edu. Or if you have a Linux system then nmap is included with the installation disks. You may have to select it for install.

An example, scanning the ports on my localhost;

[root@myhost ~]# nmap localhost

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2005-11-23 07:35 MST
Interesting ports on localhost (127.0.0.1):
(The 1650 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
199/tcp open smux
6000/tcp open X11

Nmap run completed -- 1 IP address (1 host up) scanned in 0.361 seconds

This can tell you what ports are open and listening

[Patrick Wallek]

To turn off 80 and 443, turn of Apache, or whatever web server you are using if you don't need that function.

THe NetBios ports might be enabled via inetd. Have a look at the /etc/inetd.conf file and see if there are lines for NetBios there. If so, comment them out ( a # at the beginning of the line) and then run 'inetd -c' to have inetd re-read its configuration file.

Yes a firewall is an option, but the better option is to turn the ports off completely.

[Bill Hassell]

Since none of these ports are enabled on a standard HP-UX system, is your question prompted by a scan that states the ports are active on your system? Or is this just a recommendation? A web server requires a lot of configurtion just to get it started, so if your system is not running a web server, the port is non-existant. Same with NetBios. A port appears to be active in Unix when a program opens that port, typically a networking daemon.

/etc/services is a primarily documentation file. Some programs use a library call to find a particular service, but /etc/services neither enables or disables access to a network port, or more accurately, enables or disables a network daemon that would open this port. /etc/inetd.conf is where virtually all network services are enabled. If the service is not shown in that file, then the daemon is never scheduled and the port is never open.

For completeness, it should be noted that anyone can write a program to open a specific port or set of ports. File permissions and locking can keep random programs from opening ports that are typically part of kernel networking processes.

[Indrajit_1]

Hi,

The best way u can turn off the ports by executing the command iptables.
#iptables -A INPUT -P TCP --dport 80 -J REJECT
#iptables -A OUTPUT -P TCP --dport 80 -J REJECT
#iptables -A INPUT -P TCP --dport 443 -j REJECT
#iptables -A OUTPUT -P TCP --dport 443 -j REJECT
#iptables -A INPUT -P TCP --dport 137 -j REJECT
#iptables -A OUTPUT -P TCP --dport 137 -j REJECT
#iptables -A OUTPUT -P TCP --dport 137 -j REJECT
#iptables -A INPUT -P TCP --dport 138 -j REJECT
#iptables -A OUTPUT -P TCP --dport 138 -j REJECT
#iptables -A INPUT -P TCP --dport 139 -j REJECT
#iptables -A OUTPUT -P TCP --dport 139 -j REJECT

if u face any problem, check man iptables.
it should solve ur issue..

cheers
indrajit

[Steven E. Protter]

Note: Indrajit's solution uses iptables, which does not run on HP-UX. Its a good Linux solution.

BH notes the obvious and best solution (which I should have done btw) that if no application is listening on the port, there is no need to do anything further. Turn off the web server and don't run Samba and there is nothing further to do.

If any of these answers has been helpful etc, please consider assigning points. Its how we recognize good help here.

Good Luck,

SEP