The title probably says it all. I just want to know the best techniques to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
Please, don't consider the use of external devices (like external firewalls), I wish I could only use what the distro or external packages offer.
Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks, the required port will open.
Think of portknocking as a special knock on a door for the door to open.
Here is an example from ArchLinux wiki:
$ ssh username@host
(Ctrl+c to exit) ^C
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 1111 host
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 2222 host
$ ssh user@host
user@host's password:
The user knocks port 1111 followed by 2222 to open up port 22 for SSH.
Portspoof is a program which makes interpreting port scan results very difficult, therefore slowing down being able to identify open ports.
The Portspoof program primary goal is to enhance OS security through a set of new techniques:
- All TCP ports are always open
Instead of informing an attacker that a particular port is CLOSED or FILTERED state Portspoof will return SYN+ACK for every port connection attempt.
As a result it is impractical to use stealth (SYN, ACK, etc.) port scanning against your system, since all ports are always reported as OPEN.
Every open TCP port emulates a services
Portspoof has a huge database of dynamic service signatures, that will be used to fool scanners to believe there's a legitimate service running. Scanning software usually tries to determine a service version that is running on an open port. Portspoof will respond to every service probe with a valid service signature, that is dynamically generated based on a service signature regular expression database. As a result an attacker will not be able to determine which port numbers your system is truly using.
Quoted from https://github.com/drk1wi/portspoof
Portspoof makes identifying listening services much more difficult and as the README states, it would take over 8 hours to identify which ports are actually listening. Identifying the real ports is so time consuming that the attackers will likely give up.
This guide shows how you can install Portspoof:
- Compile the software, go in the directory where you have unzipped/put the sources and give these commands:
$./configure $ make $ sudo make install
OR
$ g++ -lpthread -Wall -g Configuration.cpp connection.cpp Portspoof.cpp revregex.cpp Utils.cpp Fuzzer.cpp Server.cpp -o portspoof
- Configure your firewall rules:
iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444
iptables-restore < iptables-config (system_files directory)
Run Portspoof with service emulation:
$ portspoof -c portspoof.conf -s portspoof_signatures -D
Run Portspoof in “open port” mode:
$ portspoof -D
- Add portspoof to your system’s startup scripts. To do this modify or use the default init.d script that you can found in the ‘system_files’ directory.
Combine Portknocking with Portspoof and you've got yourself a nice defense from port scanners.
While there are some tricks you can play, e.g. blocking sources after suspicious connection attempts, all the nmaps of the world already have countermeasures as well (slow scanning, random scanning, etc.).
IMHO you should take a step back and ask yourself what you are afraid of, aka what is your threat model? If an attacker knows which ports are open, does that weaken your security? Because it shouldn't. You don't try to hide your front door, you install a proper lock, right?
If you want to be able to connect to your server without going to additional pains on the client side - there is no way to protect those ports from being scanned. It's an oxymoron. Port scanning is simply an attempt at connecting and looking at what response comes back.
If you are willing to implement additional measures on the client side, you can use something like port-knocking. Note that this will still leave some ports being open for a scanning attempt, they simply won't be the ones that have any servers running on them.
Another solution is to use Tor hidden services if speed and latency is not a big issue. This effectively makes it impossible to discover the service using port scanning and is fairly easy to do. It also offers some more privacy, such as encryption and anonymity. All you need to access the service is Tor and the ability to connect through Tor (port 9050 default) using SOCKS5. You can use proxychains or torsocks to proxify programs that do not support SOCKS5. You can also set a password for the hidden service.
You can have all your ports as hidden services and then close them from the internet.
By definition, port scanning is the process of connecting to ports and checking the response and any obvious methods of stopping port scanning will result in trouble connected to the server yourself.
There are a number of solutions which are out there which require some more configuration and the easiest one is most likely port knocking.
A few articles on port knocking:
