I was browsing here all day to get answered my Q,but couldn't found it.

So my Q is if it is possible to scan my box from another box inside network:

cabel modem
|
2 port router-----owner's box
|
eth hub-----XP box
|
MDK 9.1 box


I'd like to scan my boxes each other.Mostly box "C".I know all IPs.

I was trying scaning from "C" other boxes from MDK,but couldn't.Don't know why.My
firewall is Guarddog.And I know my box accept ICMP (found some command which showed ICMP as accepted-don't remember which one it was).

Sorry I'm kinda newbie in these things.

No.1 priority is to get my MDK box scanned from my atnohre box,or somehow (better) from this box MDK.

Sorry for so long post.Wanted to let u know as much as possible.

Thank you,

Wannalearnlinux


ps: forgot that I don't have any friends outside who knows those things,so can't try it from outside.

the graf is bad,again my net:

cabel modem--2 port router--owners XP box A---my eth hub---box B xp and box C MDK

from XP box I'm trying GFI lan guard,but it doesn't work to scan my Linux box inside the lan.

Don't know where I'm wrong.I even found that Guarddog blocks ICMP.But I know it's no true.I'll search for command which tells if ICMP is blocked or not.If u know pls post it.Otherwise I'm searching.

I'm serious,pls help newbie to secure his first Linux box

[root@localhost grinder]# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
0


...so it is accepted but still can't scan other box (XP),which doesn't have any firewall to block it.

Looks like I should buy some more books


Maybe the eth hub makes problems?Don't know.

I'll be fine with some URL.How You guys do scan your boxes? You probably have some1 who can scan your box,but I don't.

Ok, I'm sorry but I got a little lost with that, but I think I may have you answer. If I don't then let me know. On the box you trying to scan can you ping it? If you cannot and you know you have the right IP then you may need to give nmap the command to not ping it first:
nmap -P0 <ipaddr>

that is a dash-P-zero

Also, guarddog uses IPTABLES tor it's firewall. Iptables can block icmp with the use of the file you mentioned above.

If you are worried about you security you can also use ps aux to see what services/processes are running. You can use netstat -nlp to see what is listening on the different ports.

Also, ping your box to see if it's accepting ICMP packets. The other option is just to portscan yourself.

You can portscan yourself, and it will tell you somethings, but it is better to portscan from a remote location.

Do you want to verify if the box is secure against attacks from outside of the lan, or secure against local attacks?

I'm not a security expert but i have read in some security site (dont remember where) that if you want to verify if your box is secure against attacks from internet you must scan the box from outside your lan. Scanning from inside will give you incorrect results.

hope this help a little

Well... If you scan from outside the lan, you will probably end up scanning a router/firewall/gateway/NAT-box or whatever. Scanning individuall hosts inside the LAN will give correct results on open ports etc for that host.

Offcourse, If you want to test your security for the local lan, eg security against attacks from the Internet... youll have to scan your router/whatever from an outside host.

Back to the question... could you show what options you run Nmap with?

later

/Vigge

thanks so much all of you for reply.

But now I'm having different problem.I'm doing my 2nd install Linux MDK 9.1 and having problems with those NVIDIA drivers.So I can't try things you posted.

But when I'll fix that I'll be right back.

Thanx again.I appreciate it.

I'm so sorry,I had problems,I had to reinstall MDK and wasn't easy as my 2nd install of Linux.

You are right,everytime I go at GRC.com I get same results whatever changes I do.
So it is checking router,which I'm behind

So if I do scan from inside the LAN from other box and it will block everything so I'm fine if anyone gets through router from outside. Am I correct?

BTW,I can't make any changes at router cause it is not mine and he is in owner's room.I tried to get in from my box,but there is set password I don't know

I was trying ping from another box (XP) inside the LAN and Guarddog blocks it.

And commands I tried inside LAN was #nmap -sS 192.168 bla bla ,but couldn't.Said
"permission denied". But I don't have any firewall at XP box.

One more thing I don't understand.

When I do:

[root@localhost grinder]# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
0

So it is accepted,but I didn't set it in Guarddog to be accepted.I accept only FTP,HTTP,HTTPS,X,DNS.

Wierd.

ICMP is not tcp so you may have to specify guarddog to block icmp. I don't use guarddog so I'm not sure. On the nmap deal, you have to be root to give it the -sS switch. And if you run nmap as root it is defaulted into the command. You are right about the scan from grc.com. It is scanning your router. Just let the owner know about the open ports in the router. He may or may not be aware.

Which ports are open by the way? I ask because when I scan myself port 21 and 25 are always open. Even if the services are verified to be off nothing is listening on those ports and iptables is explicitly told to block them. I eventually concluded that the cable modem was to blame

Well about the router,the owner doesn't know anything.Actually I was the one who set it up,years ago with almost zero knowledge.I'll ask her (62 years old women) for the paswd.

And about the ICMP,Guarddog.Ther is 2 settings:
-Internet
-Local

So I set up LOCAL (because scanning inside LAN) to alow :
-ICMP redirect
-ICMP source quench (??)
-PING

I didn't set it in INTERNET zone.

Here are open ports:

[grinder@localhost grinder]$ nmap 127.0.0.1

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on localhost (127.0.0.1):
(The 1596 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
53/tcp open domain
111/tcp open sunrpc
953/tcp open rndc
6000/tcp open X11

Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds.

I'll have to llok what 111 and 953 are for.

Thanx for your time.