4:34 a.m.
Greetings.
After the recent security incidents I am trying to increase the security
of my computer by closing unnecessary ports from outside world.
The only listening port in my system right now is port 631 (ipp), as
"lsof -i | grep -i listen" reports:
************************************************************************
cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
cupsd 2349 root 11u IPv6 37791 0t0 TCP *:ipp (LISTEN)
************************************************************************
I tried disabling cups services, but then printing stopped working.
So ok, I need a connection from my computer to port 631 for
printing. But that port should be closed from all other computers. At
the moment it is open to the outside world (10.13.3.247 is the address
of my computer in LAN):
************************************************************************
[jarmo@localhost ~]$ nmap -sT 10.13.3.247
Nmap scan report for 10.13.3.247
Not shown: 999 closed ports
PORT STATE SERVICE
631/tcp open ipp
************************************************************************
I tried to close the port using firewalld. But the port does not seem to
be open, and firewall can not close it. I can freely take a telnet
connection to the port. The first commands show that firewalld is
running and iptables is not.
************************************************************************
[jarmo@localhost ~]$ systemctl status firewalld.service
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Fri 2014-10-31 07:27:45 EET; 3h 58min ago
[jarmo@localhost ~]$ systemctl status iptables.service
iptables.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)
[jarmo@localhost ~]$ firewall-cmd --state
running
[jarmo@localhost ~]$ firewall-cmd --get-active-zones
public
interfaces: em1
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-ports
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-all
public (default, active)
interfaces: em1
sources:
services: dhcpv6-client mdns
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
[jarmo@localhost ~]$ firewall-cmd --zone=public --remove-port=631/tcp
Warning: NOT_ENABLED: '631:tcp' not in 'public'
[jarmo@localhost ~]$ nmap -sT 10.13.3.247
Nmap scan report for 10.13.3.247
Not shown: 999 closed ports
PORT STATE SERVICE
631/tcp open ipp
[jarmo@localhost ~]$ telnet 10.13.3.247 631
Trying 10.13.3.247...
Connected to 10.13.3.247.
Escape character is '^]'.
************************************************************************
So I must be doing something wrong. My questions are:
1. Have I diagnosed the situation correctly? Is port 631 really open to
the outside world?
2. If port 631 is open, why can I not close it using firewalld?
3. What is the best way to deny connections to the port from any other
computer than that of my own? Is it the approach I have taken now?
Thank you for all your help in advance.
Jarmo
4:57 a.m.
On 10/31/14 17:34, Jarmo Hurri wrote:
Greetings.
After the recent security incidents I am trying to increase the security
of my computer by closing unnecessary ports from outside world.
The only listening port in my system right now is port 631 (ipp), as
"lsof -i | grep -i listen" reports:
************************************************************************
cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
cupsd 2349 root 11u IPv6 37791 0t0 TCP *:ipp (LISTEN)
************************************************************************
I tried disabling cups services, but then printing stopped working.
So ok, I need a connection from my computer to port 631 for
printing. But that port should be closed from all other computers. At
the moment it is open to the outside world (10.13.3.247 is the address
of my computer in LAN):
************************************************************************
[jarmo@localhost ~]$ nmap -sT 10.13.3.247
Nmap scan report for 10.13.3.247
Not shown: 999 closed ports
PORT STATE SERVICE
631/tcp open ipp
************************************************************************
I tried to close the port using firewalld. But the port does not seem to
be open, and firewall can not close it. I can freely take a telnet
connection to the port. The first commands show that firewalld is
running and iptables is not.
************************************************************************
[jarmo@localhost ~]$ systemctl status firewalld.service
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Fri 2014-10-31 07:27:45 EET; 3h 58min ago
[jarmo@localhost ~]$ systemctl status iptables.service
iptables.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)
[jarmo@localhost ~]$ firewall-cmd --state
running
[jarmo@localhost ~]$ firewall-cmd --get-active-zones
public
interfaces: em1
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-ports
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-all
public (default, active)
interfaces: em1
sources:
services: dhcpv6-client mdns
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
[jarmo@localhost ~]$ firewall-cmd --zone=public --remove-port=631/tcp
Warning: NOT_ENABLED: '631:tcp' not in 'public'
[jarmo@localhost ~]$ nmap -sT 10.13.3.247
Nmap scan report for 10.13.3.247
Not shown: 999 closed ports
PORT STATE SERVICE
631/tcp open ipp
[jarmo@localhost ~]$ telnet 10.13.3.247 631
Trying 10.13.3.247...
Connected to 10.13.3.247.
Escape character is '^]'.
************************************************************************
So I must be doing something wrong. My questions are:
1. Have I diagnosed the situation correctly? Is port 631 really open to
the outside world?
2. If port 631 is open, why can I not close it using firewalld?
3. What is the best way to deny connections to the port from any other
computer than that of my own? Is it the approach I have taken now?
Thank you for all your help in advance.
There is more than one way to achieve your goal. Also, you may have a configuration issue
with your network interface making things "obscure".
First off,
cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
Does indicate that it is listening on all interfaces. You can prevent this by editing
your /etc/cups/cupsd.conf to contain the line....
Listen localhost:631
Which will result in
cupsd 2377 root 11u IPv4 29156 0t0 TCP localhost:ipp (LISTEN)
If you do only that, the port will remain "open" but nobody outside of your
system will be able to communicate.
Next, please note that iptables.service is different from and separate to
firewalld.service. So, forget about it.
Also, you can use firewall-config to manage basic firewalld setting from a GUI.
To close the port you'd uncheck "ipp" .... kind of obvious. Now, the
kicker is that there are multiple zones and you should check to ensure your network
interface is tied to the zone you are changing.
Hope that helps....
--
If you can't laugh at yourself, others will gladly oblige.
5:09 a.m.
Ed Greshko <ed.greshko(a)greshko.com> writes:
cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
Does indicate that it is listening on all interfaces. You can prevent
this by editing your /etc/cups/cupsd.conf to contain the line....
Listen localhost:631
Which will result in
cupsd 2377 root 11u IPv4 29156 0t0 TCP localhost:ipp (LISTEN)
If you do only that, the port will remain "open" but nobody outside of
your system will be able to communicate.
I'll try this.
Next, please note that iptables.service is different from and
separate
to firewalld.service. So, forget about it.
I know, I just wanted to show that iptables is *not* running.
Also, you can use firewall-config to manage basic firewalld setting
from a GUI. To close the port you'd uncheck "ipp" .... kind of
obvious. Now, the kicker is that there are multiple zones and you
should check to ensure your network interface is tied to the zone you
are changing.
The thing is, ipp is not checked in *any* interface. This is also shown
in the outputs I gave earlier:
************************************************************************
[jarmo@localhost ~]$ firewall-cmd --get-active-zones
public
interfaces: em1
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-ports
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-all
public (default, active)
interfaces: em1
sources:
services: dhcpv6-client mdns
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
************************************************************************
These also show that my active interface is in public zone, and ipp is
not enabled. So I still do not understand how the port can be open.
Jarmo
5:59 a.m.
On 10/31/14 18:09, Jarmo Hurri wrote:
Ed Greshko <ed.greshko(a)greshko.com> writes:
> cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
> Does indicate that it is listening on all interfaces. You can prevent
> this by editing your /etc/cups/cupsd.conf to contain the line....
> Listen localhost:631
> Which will result in
> cupsd 2377 root 11u IPv4 29156 0t0 TCP localhost:ipp (LISTEN)
> If you do only that, the port will remain "open" but nobody outside of
> your system will be able to communicate.
I'll try this.
OK....
> Next, please note that iptables.service is different from and
separate
> to firewalld.service. So, forget about it.
I know, I just wanted to show that iptables is *not* running.
I see.... Good to know.
> Also, you can use firewall-config to manage basic firewalld setting
> from a GUI. To close the port you'd uncheck "ipp" .... kind of
> obvious. Now, the kicker is that there are multiple zones and you
> should check to ensure your network interface is tied to the zone you
> are changing.
The thing is, ipp is not checked in *any* interface. This is also shown
in the outputs I gave earlier:
************************************************************************
[jarmo@localhost ~]$ firewall-cmd --get-active-zones
public
interfaces: em1
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-ports
[jarmo@localhost ~]$ firewall-cmd --zone=public --list-all
public (default, active)
interfaces: em1
sources:
services: dhcpv6-client mdns
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
************************************************************************
These also show that my active interface is in public zone, and ipp is
not enabled. So I still do not understand how the port can be open.
That is "odd" what does
iptables -L -n | grep 631
Show?
--
If you can't laugh at yourself, others will gladly oblige.
9:52 a.m.
Am 31.10.2014 um 10:34 schrieb Jarmo Hurri:
So I must be doing something wrong. My questions are:
1. Have I diagnosed the situation correctly? Is port 631 really open to
the outside world?
Probably.
2. If port 631 is open, why can I not close it using firewalld?
You're very likely doing something wrong. But since I don't use
firewalld and I am not familiar with it, I can't tell you what that
might be.
3. What is the best way to deny connections to the port from any
other
computer than that of my own? Is it the approach I have taken now?
Others will probably tell you, how to use firewalld to deny access to
some open port.
OTOH: First, you tell cups to listen to the network and then you try to
use firewalld to make sure it won't succeed in doing so.
In this case, I'd consider it a much better idea to tell cups to listen
only to the loopback interface and ignore the external network
altogether - by setting "Listen" appropriately in cupsd.conf. For example:
# Only listen for connections from the local machine.
Listen localhost:631
Listen /var/run/cups/cups.sock
--
Regards
mks
1:57 p.m.
On 10/31/2014 02:34 AM, Jarmo Hurri wrote:
I tried disabling cups services, but then printing stopped working.
What else do you expect when you disable the printing service?
So ok, I need a connection from my computer to port 631 for
printing. But that port should be closed from all other computers. At
the moment it is open to the outside world (10.13.3.247 is the address
of my computer in LAN):
If you want to make sure nobody outside your LAN has access to your
printer, shut the port on your router.
1:01 a.m.
On Fri, 2014-10-31 at 11:34 +0200, Jarmo Hurri wrote:
After the recent security incidents I am trying to increase the
security
of my computer by closing unnecessary ports from outside world.
The only listening port in my system right now is port 631 (ipp), as
"lsof -i | grep -i listen" reports:
************************************************************************
cupsd 2349 root 10u IPv4 37790 0t0 TCP *:ipp (LISTEN)
cupsd 2349 root 11u IPv6 37791 0t0 TCP *:ipp (LISTEN)
************************************************************************
I tried disabling cups services, but then printing stopped working.
Naturally...
So ok, I need a connection from my computer to port 631 for
printing. But that port should be closed from all other computers. At
the moment it is open to the outside world
As others have said, you can reconfigure CUPS so that it doesn't listen
to the outside world.
As they haven't said, yet, I consider this to be the better approach.
Rather than rely on something else (a firewall) to get in the way,
configure services to be more secure, in themselves.
I can run without a firewall, at all, simply because I don't have things
listening to the world on my systems. I don't, because I'd rather have
two things looking after me, than just one. But it's mostly pointless.
--
tim@localhost ~]$ uname -rsvp
Linux 3.16.6-203.fc20.i686 #1 SMP Sat Oct 25 13:08:51 UTC 2014 i686
All mail to my mailbox is automatically deleted, there is no point trying
to privately email me, I will only read messages posted to the public lists.
George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.
12:58 a.m.
>
************************************************************************
> [jarmo@localhost ~]$ firewall-cmd --get-active-zones
> public
> interfaces: em1
>
> [jarmo@localhost ~]$ firewall-cmd --zone=public --list-ports
>
> [jarmo@localhost ~]$ firewall-cmd --zone=public --list-all
> public (default, active)
> interfaces: em1
> sources:
> services: dhcpv6-client mdns
> ports:
> masquerade: no
> forward-ports:
> icmp-blocks:
> rich rules:
> ************************************************************************
>
> These also show that my active interface is in public zone, and ipp is
> not enabled. So I still do not understand how the port can be open.
>
That is "odd" what does
iptables -L -n | grep 631
Show?
The output is empty.
The only semi-rational explanation I have for this at the moment is that
internally my LAN address 10.13.3.247 maps to localhost.localdomain, so
maybe connecting to 10.13.3.247 with nmap bypasses the firewall?
************************************************************************
[jarmo@localhost ~]$ traceroute 10.13.3.247
traceroute to 10.13.3.247 (10.13.3.247), 30 hops max, 60 byte packets
1 localhost.localdomain (10.13.3.247) 0.078 ms 0.024 ms 0.023 ms
************************************************************************
Jarmo
1:06 a.m.
Tim <ignored_mailbox(a)yahoo.com.au> writes:
As others have said, you can reconfigure CUPS so that it doesn't
listen
to the outside world.
As they haven't said, yet, I consider this to be the better approach.
Rather than rely on something else (a firewall) to get in the way,
configure services to be more secure, in themselves.
I can run without a firewall, at all, simply because I don't have things
listening to the world on my systems. I don't, because I'd rather have
two things looking after me, than just one. But it's mostly pointless.
Makes sense. In fact, after following the other advice in this thread
nmap and "lsof -i" now tell me that the only thing listening on my
computer is cups, and it is only listening to local connections.
Thanks for your help.
Jarmo
3:09 a.m.
On 11/03/14 14:58, Jarmo Hurri wrote:
The only semi-rational explanation I have for this at the moment is
that
internally my LAN address 10.13.3.247 maps to localhost.localdomain, so
maybe connecting to 10.13.3.247 with nmap bypasses the firewall?
Yes. You can't check the firewall of a system by using nmap on the same system.
--
If you can't laugh at yourself, others will gladly oblige.
3455
days inactive
3458
days old
10 comments
6 participants
participants (6)
-
Ed Greshko -
Heinz Diehl -
Jarmo Hurri -
Joe Zeff -
Markus Schönhaber -
Tim