Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #157061
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: laptop protection in an office network |
| Date | 2015-08-29 20:40 +0200 |
| Message-ID | <q2TcK-1y2-15@gated-at.bofh.it> (permalink) |
| References | (2 earlier) <q2HEC-1Ub-7@gated-at.bofh.it> <q2IAG-3ek-7@gated-at.bofh.it> <q2JwJ-4yL-5@gated-at.bofh.it> <q2MXE-Td-9@gated-at.bofh.it> <q2T34-1mE-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Hi. On Sat, 29 Aug 2015 13:25:28 -0500 rlharris@oplink.net wrote: > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > Also netstat (issued from your laptop) gives insight. For example > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > root (or sudo, of course), the extra option -p tells you which process is > > "at the other side" listening. > > > > Note that the dhcp client itself (which you need to get an IP address to > > take part in your customer's network) puts you already at some risk, > > depending on how it's configured. > > Here is the output from the laptop: > > # netstat -lntup > Active Internet connections (only servers) > Prot Rec Snd Local Address Foreign State PID/Program name > -Q -Q Address > tcp 0 0 0.0.0.0:9999 0.0.0.0:* LIS 561/inetd > tcp 0 0 0.0.0.0:111 0.0.0.0:* LIS 530/rpcbind > tcp 0 0 0.0.0.0:46225 0.0.0.0:* LIS 540/rpc.statd > tcp 0 0 0.0.0.0:22 0.0.0.0:* LIS 568/sshd > tcp 0 0 127.0.0.1:631 0.0.0.0:* LIS 1248/cupsd > tcp 0 0 127.0.0.1:5432 0.0.0.0:* LIS 675/postgres > tcp 0 0 127.0.0.1:25 0.0.0.0:* LIS 1063/exim4 > tcp 0 0 127.0.0.1:2628 0.0.0.0:* LIS 599/0 > tcp6 0 0 :::111 :::* LIS 530/rpcbind > tcp6 0 0 :::38930 :::* LIS 540/rpc.statd > tcp6 0 0 :::22 :::* LIS 568/sshd > tcp6 0 0 ::1:631 :::* LIS 1248/cupsd > tcp6 0 0 ::1:5432 :::* LIS 675/postgres > tcp6 0 0 ::1:25 :::* LIS 1063/exim4 > udp 0 0 0.0.0.0:36358 0.0.0.0:* 612/avahi-daemon:r > udp 0 0 0.0.0.0:631 0.0.0.0:* 647/cups-browsed > udp 0 0 0.0.0.0:689 0.0.0.0:* 530/rpcbind > udp 0 0 127.0.0.1:716 0.0.0.0:* 540/rpc.statd > udp 0 0 0.0.0.0:57106 0.0.0.0:* 540/rpc.statd > udp 0 0 0.0.0.0:111 0.0.0.0:* 530/rpcbind > udp 0 0 192.168.1.99:123 0.0.0.0:* 664/ntpd > udp 0 0 127.0.0.1:123 0.0.0.0:* 664/ntpd > udp 0 0 0.0.0.0:123 0.0.0.0:* 664/ntpd > udp 0 0 0.0.0.0:5353 0.0.0.0:* 612/avahi-daemon:r > udp6 0 0 :::689 :::* 530/rpcbind > udp6 0 0 :::43913 :::* 540/rpc.statd > udp6 0 0 :::111 :::* 530/rpcbind > udp6 0 0 fe80::ba70:f4ff:fe2:123 :::* 664/ntpd > udp6 0 0 ::1:123 :::* 664/ntpd > udp6 0 0 :::123 :::* 664/ntpd > udp6 0 0 :::5353 :::* 612/avahi-daemon:r > udp6 0 0 :::44274 :::* 612/avahi-daemon:r > # > > Regrettably, the formatting of the output does not consider the need to > include the output in the body of an e-mail, so editing was required to > remove excess spaces so as to prevent every line from being wrapped. Something like this should save you from the most troubles provided that you don't plan to use your laptop as a print server or NFS: iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp --dport 123 -j ACCEPT iptables -P FORWARD DROP ip6tables -P INPUT DROP ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP ip6tables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT ip6tables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT ip6tables -A INPUT -p udp --dport 123 -j ACCEPT ip6tables -P FORWARD DROP Of course, it's *very* simplistic set of rules (for example, someone may consider accepting ssh connections from arbitrary hosts a bad idea), but it should work. Two things I'm unsure of are: 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office network), but YMMV. 2) Whatever thing you're listening for on tcp 9999 with inetd. Reco
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
laptop protection in an office network rlharris@oplink.net - 2015-08-29 07:00 +0200
Re: laptop protection in an office network Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4XiX@bitmessage.ch> - 2015-08-29 08:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 08:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 09:20 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 10:20 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 14:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 18:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 18:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 20:30 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 20:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 02:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 03:30 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 03:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 04:30 +0200
Re: laptop protection in an office network Doug <dmcgarrett@optonline.net> - 2015-08-30 04:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 05:00 +0200
Re: laptop protection in an office network Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 00:20 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 05:10 +0200
Re: laptop protection in an office network David Wright <deblis@lionunicorn.co.uk> - 2015-08-30 06:40 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 07:30 +0200
Re: laptop protection in an office network Martin Read <zen75502@zen.co.uk> - 2015-08-31 03:50 +0200
quality keyboards rlharris@oplink.net - 2015-08-31 09:10 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 09:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 09:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 12:00 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:20 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 14:30 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 14:40 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 15:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 16:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 17:00 +0200
Re: quality keyboards Anthony Maples <anthonym7009@gmail.com> - 2015-09-01 00:10 +0200
Re: quality keyboards "Thomas Schmitt" <scdbackup@gmx.net> - 2015-08-31 16:10 +0200
Re: quality keyboards Haines Brown <haines@histomat.net> - 2015-08-31 13:00 +0200
Re: quality keyboards Curt <curty@free.fr> - 2015-08-31 14:20 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:10 +0200
Re: quality keyboards Gene Heskett <gheskett@wdtv.com> - 2015-08-31 14:30 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 15:00 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 15:10 +0200
Re: quality keyboards Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 15:10 +0200
Re: quality keyboards Martin Read <zen75502@zen.co.uk> - 2015-08-31 13:20 +0200
Re: quality keyboards David Wright <deblis@lionunicorn.co.uk> - 2015-08-31 17:40 +0200
Re: quality keyboards Glenn English <ghe@slsware.net> - 2015-08-31 18:30 +0200
Re: quality keyboards Don Armstrong <don@debian.org> - 2015-08-31 21:50 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:20 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:50 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:40 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 16:10 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 18:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 20:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:50 +0200
Re: laptop protection in an office network Renaud (Ron) OLGIATI <renaud@olgiati-in-paraguay.org> - 2015-08-29 23:40 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 23:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:50 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 01:50 +0200
Re: laptop protection in an office network Chris Bannister <cbannister@slingshot.co.nz> - 2015-08-30 09:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 11:10 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 21:10 +0200
csiph-web