I am told by anyone that helps me with my security whenever they run an nmap on me that i need to close 139... everyone says that is a bad port to have open yet it seems i must have it on in order network my computers... are there any serious exploits for this?

TCP port 139 is used for NETBIOS - I assume you are running samba/nmbd on you Linux box. Assuming you have everything configured as securely as possible, (and you absolutely need it to do whatever you are doing) I wouldn't worry about it.

The rule of thumb with network services is to disable anything you don't need. NETBIOS is normally one of them, but if you need it, just make sure it's secured.

If port 139 is open on the internet connection, you are at risk, if nothing more than to let a scanner know that there is a system at that ip. I don't know how your local lan and internet access is set up, but I would disable sharing on the internet connection. In Windows boxes, it's done in the adapter/service binding. In Samba, just don't configure that connection in the "hosts allow".

yeah, i get it that sharing can be a risk, however, that is a must have for my network at the moment... any ideas?

thanks

You can allow NetBios between your hosts on your LAN. However, you do not want to allow NetBios connections into your network from outside.

Hopefully you are nat'ing your PC's and they have private IP addresses. (192.168.1.1...etc)

What kind of firewall do you have? What does your network setup look like?

i have no firewalls...

my network is a server running mandrake 8.1
printer
usb dsl modem

hub--

client 1--suse 6.2

client 2--windows 2000

server has dhcp, smaba-server, and internet connection sharing running...

% nmap localhost
Starting nmap V. 2.54BETA22 ( www.insecure.org/nmap/ )
Interesting ports on localhost.localdomain (127.0.0.1):
(The 1535 ports scanned but not shown below are in state: closed)
Port State Service
53/tcp open domain
80/tcp open http
139/tcp open netbios-ssn
631/tcp open cups
901/tcp open samba-swat
953/tcp open rndc
6000/tcp open X11

Go here to find out what ports are open to the internet:

http://grc.com/default.htm

Go to the ShieldsUp part and do the Test My Shields and Port Probe thingies. It will give you an idea of how open your network is to the internet. Some of the ports available to the local host may not be available to the net.

Chijtska,

You need a host-based firewall for the computer that is directly on the internet...in this case, it looks like your windows box with Internet Connection Sharing.

Try the free version of ZoneAlarm. Something is better than nothing at all.

where would i get zone alarm? everytime i install a firewall i cant share my internet connection or files for some reason...any idea why this is?