SuSEfirewall2: Why is 137 open and Port 113 not shielded?
Hello! I am running SuSE 8.0 on my notebook and use VMware together with a Samba-Server in order to store my data in Linux and to be able to use different Virtual M$-machines. I started a Nessus in the VMWare on Linux base and scanned my system in order to ensure the correctness of the configuration. Sadly nessus tells me that from the outside Port 137 is open and netbios-names can be read. How can I ensure to fix this hole? How can I close the Port IDENT -113 with SuSEfirewall2? Thank you for any advice! -- Freundliche Grüße kind regards Ingo
In what network mode does your vmware run? Bridged? For Port 113 double check your Nessus (Nmap) log again. This port isnt "unshielded", its closed. Normally packets are DENIED, meaning that no answer will be sent back. SuSEFirewall2 sets Port on REJECT, meaning that you will get a REJECT packet when sending to this port.That is, because some applications try to contact the ident service repeatedly, which can cause a slow down in that application. A "REJECT" will tell the application after the first try, that it doesn't need to bother with ident. Ive seen this question quite a few times. What about putting this into the SDB? :P Ingo Doerrie wrote:
Hello!
I am running SuSE 8.0 on my notebook and use VMware together with a Samba-Server in order to store my data in Linux and to be able to use different Virtual M$-machines.
I started a Nessus in the VMWare on Linux base and scanned my system in order to ensure the correctness of the configuration.
Sadly nessus tells me that from the outside Port 137 is open and netbios-names can be read.
How can I ensure to fix this hole?
How can I close the Port IDENT -113 with SuSEfirewall2?
Thank you for any advice!
-- this is a maillist account, so please send personal replies to cso[at]trium[dot]de
participants (2)
-
Ingo Doerrie -
Thomas Seliger