0

I'm doing a project for my high-school and I'm trying to get the best security for my network.

I've made almost everything in my access-point configuration and I have only 3 tcp/ports open on my AP: (Let me show you the nmap scan:)

22/tcp open ssh

53/tcp open domain

8081/tcp open blackice-icecap

So, let's focus just on ports 8081 (for remote access to my AP) and 53 (for a DNS Server).

I'm wondering if there is anything in those services/ports that can be unsecured ? Or is there any chances of getting into my machine through these ports ?

Also... I'd like to know if there's any way to secure port 53 from an auxiliary/spoof/dns attack like this one: http://www.pax-pentest.net/exploitation/metasploitable-2-port-53-isc-bind-9-4-2-domain-name-server-cache-poisoning/

  • Was the nmap scan done from inside the network, or outside? It makes a huge difference for judging security, particularly for DNS. – Mark Nov 2 '14 at 20:25
  • The nmap scan was done from inside the network. I can't actually get the scan from the outside because I'm not sure if my ISP would like that ;) This AP is the gateway from my network and it's so hard for me, the high-school student to secure it without an outside access and without lots of knowlendge :/ I actually find an issue on port 8081, because when I did the nmap scan with -sV it shows that the port 8081 is used by lighttpd v1.4.31 and lighttpd had some problems with root accessing untill they finally repaired that problem in v1.4.33 ... – Dawid Zbiński Nov 2 '14 at 20:34
0

Closing unnecessary ports is a good first step, but the software running behind the ones that are open is just as important. For instance, SSH is generally considered a secure protocol, but it's still one of the most popular ways attackers try to exploit servers. It remains a popular avenue of attack not because it's inherently insecure, but because many admins get lazy - they don't bother to update the SSH server software to the latest version, ensure that all users have strong passwords, disable login from root, use certificates, create a lockout policy, etc. etc.

So as you can see, there are about a zillion things you can do just to secure SSH alone, and each one provides one extra layer of security. If you use all these measures, the chance that someone could still get in will be drastically reduced, but it will never be 0%. There's no such thing as a 100% secure system.

My point is, knowing which ports are open isn't really enough to definitively say whether your AP is secure or not. Your configuration details matter a lot, and there a ton of ways you can further increase the security of the services running on the AP. You have to find a balance - secure enough to (reasonably) be sure that no attacker would be able to get in, but not so secure that it greatly impacts usability.

Also, you seem to be focused on securing the access point itself, but what about the network that the access point is creating and the clients connected to the network? For example, you might want to implement WPA2-Enterprise or at least WPA2-Personal, enable client isolation, add a filter/IDS to prevent users from downloading malware, block P2P protocols and file sharing, add a usage agreement if this is a public network, block access to certain domains, log client traffic...things of that nature.

  • Thanks for the answer! I've already done all the configuration inside the network and yeah, sorry I wasn't sure what is needed for the answers of my questions and I didn't want to copy here the whole configuration that I wrote. What you wrote is indeed a good security, but you know, it's only an high-school project. I really want to have a good project but I can't talk about the things that I don't really understand completely myself :D Also, I'd like to show some attacks inside the network defense, so I couldn't secure it so much. – Dawid Zbiński Nov 2 '14 at 20:47
  • I didn't want to ask about SSH, because I know at least few things that I can do through it and I made few things for purpose. I only wanted to know if there's anything with those other two ports (53 and 8081) I already found some things but maybe somebody would tell something new. If you'd like to know the software that is running there: 53 is dnsmasq 2.47 and 8081 is lighttpd 1.4.31 – Dawid Zbiński Nov 2 '14 at 20:50
  • @GrafComp.net I don't know much about dnsmasq security but for the web interface on port 8081, you'll definitely want to use HTTPS rather than HTTP, for starters. With HTTP, anyone monitoring network traffic can capture your login credentials when you log in. You can also configure a lockout policy. One thing you should keep in mind, though, is that while consumer access points often have web interfaces, enterprise/commercial grade devices are often configured exclusively through a command line interface like SSH. Using ssh for this would be ideal, as it's already open. – tlng05 Nov 2 '14 at 21:12
  • Your version of lighttpd is four bugfix releases and six CVE security notices out of date; most of them don't affect you, but one could be used to crash your AP. Your version of dnsmasq is 24 bugfix versions old; fixes include remote crash and remote buffer overflow problems. – Mark Nov 2 '14 at 21:16
  • Thank you @user54791 .. I need to do something with that HTTP. I think that's the biggest problem for now and of course I will update the software that is running on these ports. – Dawid Zbiński Nov 2 '14 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.