port contrlo

[Nabil_11]

Hi,

Is there any software to Install it on Tru64 to control the opend port
I have Trucluster on 5.1


Please advice

Regards

Nabil

[Hein van den Heuvel]

Here is one of many recent articles on 'port control':

http://www.msnbc.msn.com/id/10704051/

:-)

Sorry, couldn't help myself considering your name & stated country.

Seriously though, please try to clarify your question for better help.
Are you maknig or using a daemon?
A standard task (FTP, NTP,...) or your own application?
Somethign to do with /etc/services and reserved port ranges perhaps?

Kindests regards,
Hein.

[Nabil_11]

Thanks for ur replay,

Actally I have one important customer in Jordan he need to secure TruCluster servers
So with netstate command there is too many ports at listening status, so we need to know which port to open and whcih to close
offcousre I know all known ports at /etc/servies and I know how to close it

Regards

[Steven Schweda]

> [...] we need to know which port to open
> and whcih to close

Close the ones which you don't use, and leave
open the ones which you do use. How can
anyone else know which is which?

Many people put an IP router between an
external network and the internal systems
which should be protected. Even a simple
router will offer some port filtering
capability.

[Ivan Ferreira]

Please do not remove the "r" services (rlogin, rsh, etc). Is required for the proper function of the TruCluster Software. I would recommend also the use of a firewall device in front of the cluster.

[Al Licause]

RE: The use of the rcommands on a cluster.
While it is true that the clusters require the rcommands to pass information and status checks, you can substitute the use of ssh for
the rutils by enabling EnforceSecureRutils in the /etc/ssh2/ssh2_config file on each system.

This will for the system to use s* commands anytime an r* command is used.

For more on this see section B.4 in the v5.1b Security Administration guide in the on line docs.

[Nabil_11]

many 10x for all,

Actually there is firewall for outside network,
But my customer want to assure that there is no weak point for inside people to use existing opened port as hole to log to system i'm trying to convince them thats not possible but when they execute netstat they find to many listening ports they need to know every port listening for which purpose if its OK and that normal --- fine But if there is a hole in one of these ports I need to close it


Regards