3

The title probably says it all. I just wanna know what are the best technics to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).

  • EDIT: Please, don't consider the use of external devices (like external firewalls), I wish I could only use what the distro or external packages offer. – My kutje Sep 22 '17 at 22:20
  • 1
    See here for one of many articles on port-knocking – marstato Sep 22 '17 at 22:22
  • Thank you! It's already helping me! I couldn't associate what the term "port knocking" was even having a tag with this name! I'm adding the tag now! – My kutje Sep 22 '17 at 22:28
6

Portknocking

Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks, the required port will open.

Think of portknocking as a special knock on a door for the door to open.

Here is an example from ArchLinux wiki:

$ ssh username@host
(Ctrl+c to exit) ^C 
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 1111 host
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 2222 host
$ ssh user@host
user@host's password:

The user knocks port 1111 followed by 2222 to open up port 22 for SSH.

Portspoof

Portspoof is a program which makes interpreting port scan results very difficult, therefore slowing down being able to identify open ports.

The Portspoof program primary goal is to enhance OS security through a set of new techniques:

  • All TCP ports are always open

Instead of informing an attacker that a particular port is CLOSED or FILTERED state Portspoof will return SYN+ACK for every port connection attempt.

  • As a result it is impractical to use stealth (SYN, ACK, etc.) port scanning against your system, since all ports are always reported as OPEN.

  • Every open TCP port emulates a services

Portspoof has a huge database of dynamic service signatures, that will be used to fool scanners to believe there's a legitimate service running. Scanning software usually tries to determine a service version that is running on an open port. Portspoof will respond to every service probe with a valid service signature, that is dynamically generated based on a service signature regular expression database. As a result an attacker will not be able to determine which port numbers your system is truly using.

Quoted from https://github.com/drk1wi/portspoof

Portspoof makes identifying listening services much more difficult and as the README states, it would take over 8 hours to identify which ports are actually listening. Identifying the real ports is so time consuming that the attackers will likely give up.

This guide shows how you can install Portspoof:

  1. Compile the software, go in the directory where you have unzipped/put the sources and give these commands:

$./configure $ make $ sudo make install

OR

$ g++ -lpthread -Wall -g Configuration.cpp connection.cpp Portspoof.cpp revregex.cpp Utils.cpp Fuzzer.cpp Server.cpp -o portspoof

  1. Configure your firewall rules:

iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444

iptables-restore < iptables-config (system_files directory)

Run Portspoof with service emulation:

$ portspoof -c portspoof.conf -s portspoof_signatures -D

Run Portspoof in “open port” mode:

$ portspoof -D

  1. Add portspoof to your system’s startup scripts. To do this modify or use the default init.d script that you can found in the ‘system_files’ directory.

Combine Portknocking with Portspoof and you've got yourself a nice defense from port scanners.

1

If you want to be able to connect to your server without going to additional pains on the client side - there is no way to protect those ports from being scanned. It's an oxymoron. Port scanning is simply an attempt at connecting and looking at what response comes back.

If you are willing to implement additional measures on the client side, you can use something like port-knocking. Note that this will still leave some ports being open for a scanning attempt, they simply won't be the ones that have any servers running on them.

0

While there are some tricks you can play, e.g. blocking sources after suspicious connection attempts, all the nmaps of the world already have countermeasures as well (slow scanning, random scanning, etc.).

IMHO you should take a step back and ask yourself what you are afraid of, aka what is your threat model? If an attacker knows which ports are open, does that weaken your security? Because it shouldn't. You don't try to hide your front door, you install a proper lock, right?

0

Another solution is to use Tor hidden services if speed and latency is not a big issue. This effectively makes it impossible to discover the service using port scanning and is fairly easy to do. It also offers some more privacy, such as encryption and anonymity. All you need to access the service is Tor and the ability to connect through Tor (port 9050 default) using SOCKS5. You can use proxychains or torsocks to proxify programs that do not support SOCKS5. You can also set a password for the hidden service.

You can have all your ports as hidden services and then close them from the internet.

0

The only way to avoid it is disconnect it from the internet or shut it off.

None of the above mentioned methods or techniques is going to completely evade being scanned.

Another solution is to use Tor hidden services if speed and latency is not a big issue. This effectively makes it impossible to discover the service using port scanning

Unfortunately you are wrong and no I am not going to go into detail why or how to do it.

  • Welcome - I think you should reconsider going into detail, since the quote you deem being wrong seems to be reasonably right that only a port scan on a correctly configured (e.g. firewalled) hidden service is not going to work practically (because hidden services identifiers are not easily enumerable). – Tobi Nary Jul 19 at 7:15
-1

By definition, port scanning is the process of connecting to ports and checking the response and any obvious methods of stopping port scanning will result in trouble connected to the server yourself.

There are a number of solutions which are out there which require some more configuration and the easiest one is most likely port knocking.

A few articles on port knocking:

-Digital Ocean

-HowToForge

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.