Quantcast
Channel: Ignite Realtime: Message List
Viewing all articles
Browse latest Browse all 12162

Re: port-scanning - how to hide Openfire information ?

$
0
0

you cannot.

 

if your server is accessible on the public internet, then anyone will be able to tell what its doing.

 

it's common for people to think that by switching ports, they are hiding their running services. unfortunately as you have seen, you cannot hide from nmap.

 

Nmap works by crawling every possible port number, and sends a variety of packets at every port until it provokes a response from the running service. the response, often times leaks a lot of information about the running service, as you have seen above. once nmap knows a service is running on a particular port, it will do more things to expose more inforamtion. your server is not just advertising this data, but it's coming out in it's normal server respones. nmap will aslo make guesses at what is running based on packet information it gets back from the server, so it does not necessarily mean your server is just telling it everything, but rather nmap is very smart.

 

changing service port numbers is, however, a good way to avoid the low-tier "dumb" bots that crawl the internet, ie, if someone wrote a bot that looks for xmpp servers on the default port.

 

you need to not worry about hiding what your server is... but rather protecting it so that even if somebody has this info, there's not much they could do with it. Make sure you have proper firewalling for all ports you do not wish to expose to the public internet. make sure you have strong passwords for not just administrator accounts, but all accounts. Make sure the server OS is updated regularly so it has the recent vulnerbility patches, disable any OS-level user accounts not in use and not needed by the server to operate, etc. Just the normal good-server practices.


Viewing all articles
Browse latest Browse all 12162

Trending Articles