Do you use nmap ???

[mack_guy911]

i wondering if you use nmap or zenmap

also what measures taken to block unnessary ports and servers .......etc

please put your comments a healthy discussion is really appreciated

[U308]

zenmap - since you mentioned it elsewhere (I think on Wilders).

Thanks mack_guy.

[helikaon]

Hi,
i use nmap, there is no gui on our servers so ...

For blocking regarding networking:

- on all levels of iso/osi or tcp/ip protocol: netfilters (iptables), e.g. you can even block torrents and any p2p networks with it, if you patch kernel and add L7 and / or ipp2p modules to kernel netfilters modules
- in tcp layer of tcp/ip i use tcpwrappers (if binary is compiled with support of libwrap)
- and of course there is application layer, where any networking capable application has its own config files regarding network settings ...


cheers,

[mack_guy911]

thanks for info helikaon )

[helikaon]

Np man
I still think the netfilters is very powerfull tool. In hands of experienced admin the cheap linux gateway can supply the sky high prices for cisco hw and licenses

[mack_guy911]

i agree i am using astaro security gateway i got little idea what its capable of yesterday on nmap i try halfsyn on my internal network it even block that which hardly seen on routers

[theNADS]

I used to use zenmap most of the time, but more recently i use nmap as it seems quicker to me. I may be wrong but I also think it seems to provide a little more info than zenmap.

To block ports i use an iptables script. I have used shorewall in the past but an iptables script is much quicker than waiting for a shorewall check to complete every time a rule is changed. However, if i have a gateway with a few interfaces and lots of rules I always use shorewall. It is still easy to make an error even with the shorewall rules file, which is more easily human readable than an iptables script (in my opinion).

In addition I use TCP wrappers on any severs exposed to abuse from joe public.

I may be going off topic a little, but Monowall is also very useful at blocking traffic before it gets near your server (firewall/router distro based on freeBSD).

[mack_guy911]

theNADS here

http://scientificlinuxforum.org/index.php?showtopic=935