I dont want to filter the port, I want to close it i dont understand why i easly can close port 6000 on slackware and mandrake but suse just cant On Tuesday 20 January 2004 9:03 am, Philippe Vogel wrote:

...

david wrote:

...

is there another configuration file to close this port ?

/etc/opt/kde3/share/config/kdm

This may/should be a link (or /opt/... should be)

With yast you can configure there is no remote access to X.

If you want to have ports not closed but in steath mode you will have to patch iptables with the grsecurity iptables-patch (you will need kernel sources as well). This patch implements steathmode for filtering (afaik this will even not work with ack-packets scans).

Philippe

I've had problems with this too. My workaround what I use now is instead of starting Xwindows with startx from the console, I use the following script. On Tue, 20 Jan 2004, Lindomar Santos wrote:

To: david From: Lindomar Santos Subject: Re: [suse-security] closing port 6000

Hi David,

You have to edit /etc/opt/kde3/share/config/kdm/Xservers

:0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp

ps: In suse box 8.2

__|__ By Lindomar, o---*--(*)--*---o http://wecanstopspam.org

On Tue, 20 Jan 2004, david wrote:

...

I dont want to filter the port, I want to close it i dont understand why i easly can close port 6000 on slackware and mandrake but suse just cant

On Tuesday 20 January 2004 9:03 am, Philippe Vogel wrote:

...

...

david wrote:

...

is there another configuration file to close this port ?

/etc/opt/kde3/share/config/kdm

This may/should be a link (or /opt/... should be)

With yast you can configure there is no remote access to X.

If you want to have ports not closed but in steath mode you will have to patch iptables with the grsecurity iptables-patch (you will need kernel sources as well). This patch implements steathmode for filtering (afaik this will even not work with ack-packets scans).

Philippe

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

On Jan 20, Richard wrote:

Now, if I can find out (or you folks can tell me ;-)) why port 111 - sunrpc is open... # netstat -anp | grep :111 tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 940/portmap

Just remove the portmap service (insserv -r portmap ; rcportmap stop). But you can only do this, if you don't use NFS mounts! (they rely on portmap) Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

Richard wrote:

Now, if I can find out (or you folks can tell me ;-)) why port 111 - sunrpc is open...

portmap is probably running, disable it by going to yast -> system -> Runlevel Editor. Now NFS won't work unless you enable portmap again.

I also had the problem until now, but this solution works for me too. The only ports open at this time are ssh / 22 and mysql / 3306, and i want to close port 3306. could you please tell me how to do this? Add to the init script /etc/init.d/mysql in the else branch of the start)

On Jan 20, gregor wrote: section the following line (between the other options) --bind-address=127.0.0.1 \ (don't forget the trailing backslash!) I really wonder, why this isn't even configurable with a config file/yast...? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \