LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 09-09-2010, 08:23 AM   #16
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled

You should always prefer to block ports at firewall level. TCP wrappers can be used but it is the responsibility of a service to check for the tcp wrappers configuration and check if connections are allowed or denied. In sense, connections are allowed to the system and hence not as secure as firewalls.
While this all said, if you want to deny connections you should use firewalls or tcp wrappers, but stopping a service does not solve the issue in a correct way if you want service running for your purpose.

Last edited by linuxlover.chaitanya; 09-09-2010 at 08:24 AM.
 
3 members found this post helpful.
Old 09-09-2010, 12:27 PM   #17
14moose
Member
 
Registered: May 2010
Posts: 83

Rep: Reputation: Disabled
Dead wrong:
Quote:
kills the service if it's running right now. That's the answer. All the rest of this talk about xinetd, hosts.[allow|deny], firewalls, tcp wrappers, etc. is about configuring and controlling access to a running service.
linuxlover.chaitanya is correct:
Blocking the port AND disabling the service are both EQUALLY important.

Last edited by 14moose; 09-09-2010 at 12:29 PM.
 
2 members found this post helpful.
Old 09-09-2010, 01:30 PM   #18
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Actually ... if there's nothing LISTENING on the port blocking
it at a firewall layer makes no sense, really. Just extra CPU
cycles burnt for no good reason. It's like putting a pad-lock
up on a wall (instead of on a door).

It won't harm (anything but your wallet), but it won't improve
the safety of your home.


Cheers,
Tink

Last edited by Tinkster; 09-10-2010 at 01:53 AM.
 
1 members found this post helpful.
Old 09-10-2010, 01:07 AM   #19
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
There is no mention that service is not listening. And the thread title says it all, OP wants to block the smtp and ftp requests. He might not have an idea if requests are coming or not.
And I have already said this,
Quote:
if you want service running for your purpose.
 
1 members found this post helpful.
Old 09-10-2010, 01:31 AM   #20
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Quote:
Originally Posted by linuxlover.chaitanya View Post
There is no mention that service is not listening. And the thread title says it all, OP wants to block the smtp and ftp requests. He might not have an idea if requests are coming or not.
And I have already said this,
Indeed ... so you're just proving my point. :}


It's part of a hardening exercise, getting rid of
unnecessary services. To me this suggests disabling.

Even if BLOCKING is the desired result it's silly
to keep the service running and drop all its packets
via firewall; you're using two lots of memory and
CPU cycles - for what? Keeping the server room warm?

After all pinga didn't say "I want to disallow certain
machines to talk ftp and smtp at my server". The desired
result implied by "block" is no traffic. And that's more
easily (and cheaper in terms of system resources) done
by turning the service off.


Cheers,
Tink
 
1 members found this post helpful.
Old 09-10-2010, 01:37 AM   #21
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
This what I meant in my first post here. But my point responding here was not that. Most people were talking about using TCP wrappers. my main response was to this issue that if need arise to block the requests to certain port, better way is to use iptables firewalls instead of TCP wrappers.
 
1 members found this post helpful.
Old 09-13-2010, 12:49 AM   #22
pinga123
Member
 
Registered: Sep 2009
Posts: 684
Blog Entries: 2

Original Poster
Rep: Reputation: 37
When i started the thread i never thought of getting these many replies .Thanks guys specially Chaitanya for clearing most of doubts in my mind.

U guys rock the forum.

This is what i have learned from this thread Correct me if i m wrong.

The best way to disable any service is to block its port using firewall as well as block the service using chkconfig This prevents service to unnecessarily generate packets that get blocked by firewall in case the port is blocked.

Next for customized service block request tcp wrapper files comes handy.

I m still little unconfirtable with /etc/xinetd.d/ but i think over the time i will learn about this.
Once again thanks .
 
Old 09-13-2010, 01:11 AM   #23
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Quote:
Originally Posted by pinga123 View Post
The best way to disable any service is to block its port using firewall as well as block the service using chkconfig This prevents service to unnecessarily generate packets that get blocked by firewall in case the port is blocked.
No. Even though my response was flagged as unhelpful
by several people it's not correct to primarily block
the port via firewall.

If the service isn't running there's no need for a
firewall rule for it; as I pointed out already you're
just wasting RAM and CPU cycles to maintain lists and
filter packets against extra ports that no one would
be listing on in the first place.

A firewall rule makes sense if you want to block CERTAIN
people (IPs, subnets, ...) from accessing a service
you don't want to shut down all together.

It's a weird thought that numbers of opinion may become
more important than understanding the task at hand. =D
For me this thread is a classic case against the rating
scheme we introduced here at LQ.



Cheers,
Tink
 
1 members found this post helpful.
Old 09-13-2010, 01:12 AM   #24
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
No. The best way to disable service is to not start it. Disable it with chkconfig. If this is the case, no need to block it at firewall. It will anyhow not accept the connections. But if you need to keep the service running but want to cut out the incoming connections from specific addresses, then use firewall, better than TCP wrappers.

Tink beat me on this. Finally we have same opinion.

Last edited by linuxlover.chaitanya; 09-13-2010 at 01:14 AM.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Binding SMTP service into IP tables, and redirecting SMTP to port 366 bamquest6 Linux - Software 1 09-24-2008 03:48 AM
Block a Particular User through FTP service karthi Linux - Security 1 11-07-2005 04:57 PM
Block a Particular User through FTP service karthi Linux - Security 1 11-07-2005 03:23 PM
How can block my SMTP Traffic? krishnakishore Linux - Networking 3 06-19-2004 08:49 AM
how to block an ip from using SMTP woho Linux - Networking 4 03-05-2004 11:48 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 11:58 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration