LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-27-2005, 11:42 AM   #1
AlexJ
LQ Newbie
 
Registered: Feb 2004
Distribution: LinuxMint, Ubuntu Server, RHEL7 (in the past: Ubunu, Debian, Suse, Fedora, RedHat)
Posts: 29

Rep: Reputation: 15
Anti-port sanning


Is there a way to stop some to scan my computer for opened ports? Someone i know did something so i taks about a min to scan (the one who scans gets bored)
Any ideeas?
 
Old 03-27-2005, 12:17 PM   #2
frgtn
LQ Newbie
 
Registered: Mar 2005
Location: Kaunas, Lithuania
Distribution: Slackware 10.1
Posts: 28

Rep: Reputation: 15
Did you try disabling icmp echo reply? I've noticed it takes longer when scanning machines which don't reply to nmap's pings.
 
Old 03-27-2005, 12:17 PM   #3
DoubleOTeC
Member
 
Registered: Aug 2003
Location: Dominica
Distribution: RedHat, FC1, FC3, FC4
Posts: 266

Rep: Reputation: 30
I figure, if your firewall rules are strict enough your desired result may be acheived.

For example, setting your INPUT policy to DROP and adding other rules to allow what you want may help.

Look into firewall rules.
 
Old 03-27-2005, 01:29 PM   #4
Half_Elf
LQ Guru
 
Registered: Sep 2001
Location: Montreal, Canada
Distribution: Slackware; Debian; Gentoo...
Posts: 2,163

Rep: Reputation: 46
the usual (read : nmap) scanners usually use SYN tcp flag to know if a port is open or not. So limiting the number of syn flag you allow would really slow down a scanning ( it could maybe even make it hang I believe). So setting a limit rules about SYN flag would be an idea.
HOWEVER, be aware this might be used against you, someone knowing the tricks could just send you endless stream of SYN to make your computer stop responding to connection (basic DDOS). If you plan to use this, make sure to place this carefully in your firewall, make sure any critical service ACCEPT communication before the limit rule is checked.

Ps : if you just want port to appears as CLOSED instead of firewalled, you could use "-j REJECT --reject-with tcp-reset" instead of DROP. This often confuse ports scanners.
 
Old 03-29-2005, 01:01 AM   #5
johnnydangerous
Member
 
Registered: Jan 2005
Location: Sofia, Bulgaria
Distribution: Fedora Core 4 Rawhide
Posts: 431

Rep: Reputation: 30
try portsentry the best about that stuff AFAIK also manageable via webmin
 
Old 03-30-2005, 06:46 PM   #6
Krugger
Member
 
Registered: Oct 2004
Posts: 229

Rep: Reputation: 30
if you change you iptables default policy to drop it will take forever to scan you completely, although it does'nt stop it. And don't blacklist people for scanning you because the source address can be spoofed.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Anti Virus/ Anti Spam for Linux? Sp@rticus Linux - Software 3 11-18-2005 02:17 AM
Best Anti-spam and Anti-virus application? vittibaby Linux - Newbie 6 10-21-2003 07:21 AM
Creating an ultimate anti-virus and anti-spam email gateway markcc Linux - Networking 2 10-08-2003 03:10 AM
Anti trojan and anti virus--Iparmor ppsl Linux - Security 1 12-03-2002 04:33 AM
Anti-Microsoft or Anti-Propietary? Hano General 4 06-19-2002 11:11 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration