firestarter launch at startup, ok?

dapper128 · 09-11-2006, 09:51 AM

fs-security.com/docs/faq.php
I followed the faq and it works, firestarter goes to systray on startup.

added to /etc/sudoers
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
username ALL= NOPASSWD: /usr/sbin/firestarter

added to Startup programs
sudo firestarter --start-hidden

I just want to be sure, that I understand it correctly.
Hope it's ok to ask, but kind of a dumb place to make a mistake.
This is only a local security risk?

Ubuntu Dapper

acid_kewpie · 09-11-2006, 10:14 AM

be aware why you are doing this in the first place... firestarter is NOT a firewall, it's a firewall configuration and monitoring tool. as long as iptables is loading on boot the firewall configuration that firestarter created will be successfully loading. you do not need to load this to be protected.

dapper128 · 09-11-2006, 11:15 AM

Ok, thank you.

I got a second question, related to nmap.

I am trying nmap. I don't know a lot about it and need to read some.

I am using this command-

Code:

nmap -sS -P0 -p 1-65535 localhost

Can I do this to scan locally? Will it give the same output as if I made a remote scan?

Code:

Starting Nmap 4.11 (insecure.org/nmap/ ) at 2006-09-11 18:03 CEST
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 65530 closed ports
PORT      STATE SERVICE
80/tcp    open  http
631/tcp   open  ipp
8118/tcp  open  unknown
40343/tcp open  unknown
60846/tcp open  unknown

This is the output I get.

I understand 80, goggle told me that 631 ipp is printer related. 8118 is for proxy as fare as I know.
The last two I really don't get?

Is a local scan any good?
If there's any problem with any of these ports being open, how do I close them?

dapper128 · 09-11-2006, 02:06 PM

I can't do a port scan from sysgate or grc, because I am behind a firewall provided by ISP. I can access it to configure, but I can't turn it of. At the same time, I am on a LAN with the rest of the people in the building. So we are advised to use a software firewall.

I understand that firestarter is just a easy (which is good) GUI for the iptables.
I would just like to test it.

dapper128 · 09-11-2006, 03:58 PM

So I managed to do a remote scan, with the help of a friends laptop.

Code:

nmap -T Aggressive -P0 -sT -r -O -p 1-65535

Code:

Starting Nmap 4.11 ( http://www.insecure.org/nmap ) at 2006-09-11 21:56
Warning:  OS detection will be MUCH less reliable because we did not find at lea
st 1 open and 1 closed TCP port
Insufficient responses for TCP sequencing (0), OS detection may be less accurate

Insufficient responses for TCP sequencing (0), OS detection may be less accurate

Insufficient responses for TCP sequencing (0), OS detection may be less accurate

Interesting ports on:
Not shown: 65532 filtered ports
PORT    STATE SERVICE
21/tcp  open  ftp
25/tcp  open  smtp
110/tcp open  pop3

Too many fingerprints match this host to give specific OS details

Nmap finished: 1 IP address (1 host up) scanned in 2872.511 seconds

How would I close those posts if I wanted to?

ps
I know how to edit, but since it's new info, I am guessing it's ok.

edit
http://iptables-tutorial.frozentux.n...-tutorial.html
god more then I really want to know

ill have a look at it.

If I don't use ftp, should I just not close the port?
Or does it matter at all?