[SOLVED] Open Port Security

Peter_APIIT · 08-04-2015, 12:03 AM

Dear All, I wonder any security problem with this configuration:

unbound - dnscrypt-proxy
Squid
dhcp
ntpd

Quote:

Active Internet Connection (including servers)

Proto Recv-Q Send-Q Local Address Foreign Address (State)
ip 0 0 *.* *.* 1

tcp 0 0 127.0.0.1:53 *.* LISTEN
tcp 172.16.1.1:53 *.* LISTEN
tcp 127.0.0.1:443 *.* LISTEN
tcp 127.0.0.1:3128 *.* LISTEN
tcp 127.0.0.1:3129 *.* LISTEN

udp *.514 *.*
udp *.* *.*

Thanks.

sundialsvcs · 08-04-2015, 06:31 PM

There is not, per se, any "intrinsic vulnerability" associated with a particular TCP/IP port being "open," to access by particular range(s) of TCP/IP addresses that you are aware-of and intend.

You simply need to practice "the principle of least access." A firewall is your stupidest, therefore "first and most basic," line of defense. (Never try to reason with a Troll.) Therefore, be sure that you allow access to "nothing and no-one else but" "the minimal Scope Of The Universe that is required."

For instance: dhcpd. Who, exactly, might this daemon need to provide internet-addresses to? Or, ntpd? Who, exactly, might legitimately ask this daemon for the time-of-day?

And so it goes. . .

Peter_APIIT · 08-04-2015, 08:59 PM

Quote:

Originally Posted by sundialsvcs

There is not, per se, any "intrinsic vulnerability" associated with a particular TCP/IP port being "open," to access by particular range(s) of TCP/IP addresses that you are aware-of and intend.

You simply need to practice "the principle of least access." A firewall is your stupidest, therefore "first and most basic," line of defense. (Never try to reason with a Troll.) Therefore, be sure that you allow access to "nothing and no-one else but" "the minimal Scope Of The Universe that is required."

For instance: dhcpd. Who, exactly, might this daemon need to provide internet-addresses to? Or, ntpd? Who, exactly, might legitimately ask this daemon for the time-of-day?

And so it goes. . .

dhcpd - Only Internal Interface
unbound/dnscrypt-proxy - localhost and Internal Network
ntpd - localhost only
squid - Internal network

Peter_APIIT · 08-24-2015, 12:43 AM

Problem solved.