A Bunny for testing my FTP and Telnet access

[Vernon Brown_4]

Four times this week; latest this morning; my Apache server would not boot; had to reformat and restore from backups. I suspect maybe it is being hacked.

I've tried to set up Ipchains to block FTP and Telnet access from the Internet while allowing it from my LAN. You should not be able to telnet or ftp to:

stkusers.com

but http should work. Test it for a bunny ??

HP 8500 running RedHat 7.1 Apache server which doubles as a proxy for my LAN to the internet.

Thanks;
Vern

[Alexander Chuzhoy · Accepted solution]

all of the specified above is open .i.e. I could connect to ftp, telnet and http.

[Nicolas Dumeige]

This is for the http :

Welcome to Stkusers home page
Here you will find free horse race handicapping and analysis software and our professional Stk2002 handicapping and analysis system.
[ 4409 ]

For FTP and telent, what is the IP to test ?

[Nicolas Dumeige]

Alexander, that's kind of a paid hack !

[Vernon Brown_4]

Thanks;

I'm still trying to turn off telnet and FTP.

I just removed port 21 and 23 from my Ipchains ACCEPT list. Another try ??

IP is 66.112.33.128

[Hazem Mahmoud_3]

I was able to telnet (get a login prompt) but I was not able to ftp. So it looks like you were able to turn off the ftp port but the telnet port is still active.

-Hazem

[Hazem Mahmoud_3]

Actually, let me take that back. I was also able to ftp. It just took a long time, but I was able to get a prompt.

-Hazem

[Vernon Brown_4]

Thanks guys !!

Looks like I have more work to do.

[Hazem Mahmoud_3]

Vernon,
Did you restart xinet.d after making the changes?

-Hazem

[Vernon Brown_4]

I think I don't understand everything I know about ipchains. I did reboot after removing ports 21 and 23. First I removed my commenting them out; didn't work; so then I deleted them; didn't work.

I'll try switching to IPTables. I think I still have instructions that SEP posted.

Thanks for all your help !!

[Peeyush]

Since u r working on it vermon, keep the follwing in mind.....

this is report of all ur open port..

Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop-3
111/tcp open sunrpc
135/tcp filtered loc-srv
139/tcp filtered netbios-ssn
161/tcp filtered snmp
443/tcp open https
445/tcp filtered microsoft-ds
593/tcp filtered http-rpc-epmap
707/tcp filtered unknown
1024/tcp open kdm
4444/tcp filtered krb524

go to http://geocities.com/peeyush_maurya/
and look for
- List of all Application Ports
- List of all Trojan Ports
will show u what some ports means

work on SMTP :::can be used for spamming

if u r not comfortable with iptables ...try fwbuilder http://www.fwbuilder.org/

Regards
Peeyush

[Hazem Mahmoud_3]

I think actually for Red Hat 7.1, you should use iptables (see this site: http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html).

Below are the step-by-step instructions on how to do it:

http://www.webmo.net/support/linux72.html

Hope that helps! The weekend is here!!!

-Hazem

[Vernon Brown_4]

Thanks; I have switched to iptables; now to get the rules to do what I need :o)

[Peeyush]

verm

use following command to scan ur/any ip for open ports, it helps to check ur own and others security

#nmap -sS 1.2.3.4

where 1.2.3.4 is ur IP

Regards,
Peeyush

[Martin P.J. Zinser]

Hello Vern,

an just in case you do not have nmap around it can be found at

http://www.insecure.org/nmap/

Greetings, Martin

[Vernon Brown_4]

Thanks Martin; I didn't have it. Your link saved me lots of looking :o)