possible to close all ports? can you still be hacked?

servnov · 01-03-2006, 04:16 PM

So there are 65k ports available, is it possible to close all of them to incoming connections? If all your ports are closed can a remote hacker still get in? Can closed ports be forced open and that is where a filtered port comes in?

int0x80 · 01-03-2006, 04:20 PM

Code:

iptables -P INPUT DROP

Mara · 01-03-2006, 04:26 PM

You can close all the ports. It means, in fact, shutting down all applications listening on them. Possible and doable. It does much to make intruder's life harder, but it doesn't make the compromise impossible. You may be tricked into running a script or checking a page that results in malicious software beeing run on your machine, for example. Closing all ports helps, but you still need to be careful.

Closed ports can be only made open if an application (running on your machine) opens them. If you're in control of your programs, you may be quite sure they won't do such thing

tkedwards · 01-03-2006, 04:32 PM

Quote:

So there are 65k ports available, is it possible to close all of them to incoming connections?

Yes, as GNUbie pointed out. If you don't like writing iptables commands directly try something like Firestarter of Guarddog which provide GUIs for setting up your firewall.

Quote:

If all your ports are closed can a remote hacker still get in?

Possibly. Security is a complex thing with browser vulnerabilities and the like. However closing all ports to outside connections is a massive help and if you use the computer sensibly your very unlikely to get hacked in Linux.

Code:

Can closed ports be forced open and that is where a filtered port comes in?

Not really. If a firewall is set to not accept traffic on a port then it won't. What exactly do you mean by filtered? It can have different meanings when it comes to ports.

A firewall can either accept a packet on a port (ie its not 'firewalled'), drop the packet and send no response or drop the packet and send a response saying that the port is closed. For most home users just dropping the packet and sending no response is fine and is probably the default on programs like Firestarter and Guarddog.

servnov · 01-03-2006, 06:26 PM

Quote:

Originally Posted by Mara

You can close all the ports. It means, in fact, shutting down all applications listening on them. Possible and doable. It does much to make intruder's life harder, but it doesn't make the compromise impossible. You may be tricked into running a script or checking a page that results in malicious software beeing run on your machine, for example. Closing all ports helps, but you still need to be careful.

Closed ports can be only made open if an application (running on your machine) opens them. If you're in control of your programs, you may be quite sure they won't do such thing

Ah, yes client software flaws could be an avenue of attack. Didnt think of that. Thanks for help.

servnov · 01-03-2006, 06:30 PM

Quote:

Originally Posted by tkedwards

What exactly do you mean by filtered?

Just going on with what a network mapper (ex. nmap) reports: open, closed, or filtered.

Quote:

Originally Posted by tkedwards

drop the packet and send no response or drop the packet and send a response saying that the port is closed.

This would be the -j DROP and -j REJECT options in iptables, respectively. Correct? Does it just save bandwidth and time to not send a reponse back?

tkedwards · 01-03-2006, 06:56 PM

AFAICT:

Open in nmap is ACCEPT in iptables, ie. a connection can be made

Closed in nmap is REJECT in iptables, ie. the incoming packet is dropped and a response packet saying so is sent back

filtered in nmap is DROP in iptables, ie. the incoming packet is dropped without a response being sent back