Netstat and open ports

Quote:

---

How do I turn them off?

---

Control panel
Add/remove programs
Add/remove windows components

In this section you will see the services listed under one of the network services categories, though at the moment I can't think of the exact name of the category.

He had to willingly turn them on. They don't come enabled by default nor does a lot of the stuff he is running.

Also, tons of useless services come with Windows server platforms. You don't need 70% of them in typical environments.

Be VERY careful about disabling RPC (port 135). If you do this incorrectly, you'll be dusting off your install CD very quickly.

You don't need daytime running. NTP can stay there if you're syncing to an outside time server at NIST or the US Navy, etc.

Someone gave you a link to Black Viper's windows services list. Use it. It gives you detailed descriptions of what services do and which ones will be impacted should you disable them. Everyone has a different set of requirements so what one person runs another will not. Set up your host per your own needs. No one can answer that except you.

Turning off CIFS (NetBIOS over TCP port 445) can be done with the reg hack as posted by ComputerNerd22. If you don't like mucking in the registry, use the clicky checkbox method I posted in this thread. It does the same exact thing.

In the past I posted a Win32 server hardening guide. Once Negative gets the tutorials links back in order, you can use that guide to harden your Win32 server. I go into great detail about hardening the server services, network stack and so on. To date, *none* of my internet facing windows boxen have been pwned. I used the very same guide I wrote to harden those boxen.

If you can't wait for the links to get fixed, send me a PM and I will forward you the doc.


--TH13

Quote:

---

He had to willingly turn them on. They don't come enabled by default nor does a lot of the stuff he is running.

---

Thus my comment "skiddie toolkit" why else would you turn on character generator? ;) I remember some DNS attacks back when on NT 4 Servers.

Quote:

---

One other thing is about port 135. I came across a complicated article which mentioned disabling RPC. Mine is set to start automatically. I don't think that I need it on a single laptop behind an ADSL router. What I could understand mentioned that it would be needed in a large (client/server) network. The article also mentioned disabling things like Windows Time, SSDP Discovery Services, Remote Desktop Help Servives Manager, Com+ Event System, Com+ System Application, System Event Notification (do I really want to do that?) and Task Scheduler (do I really want to do that either?). I've never heard of most of these so I'm relatively happy to disable them but there are some which I think I ought to keep. Any comments?

---

Be cautious about disabling port 135 it might be more trouble than it's worth.
Also, I would recommend disabling Windows Time and SSDP Discovery services, and remote desktop, help services manager, System event I have my enabled. Same with task shecdular
COM+ system application 'C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}' part of RPC I wouldnt disable nor would I disable COM+ Event system

Gee - this is complicated!

I checked in Services and there's an entry "Simple TCP Services" which suipports Character Generator, Daytime, Discard, Echo and Quote of the Day. I'll go ahead and disable it, along with Windows Time, SSDP Discovery Services and Remote Desktop Help Services Manager. I'll keep System Event Notification and Task Scheduler, along with the COM+ Event System and COM+ System Application. That seems to have everythig covered, doesn't it?

I'm glad that I didn't disable port 135 if the process might render my system unusable!

Quote:

---

That seems to have everythig covered, doesn't it?

---

lol no way. If you havent already disabled the following I would still recommend disabling services/features
example, (ClipBook,remote registry,Indexing Service, etc...) Do you run a wireless network? If not, disable wireless zero configuration.


For 'basic security' for windows xp I do recommend the following
http://labmice.techtarget.com/articl...ychecklist.htm
Cheers, cn22

Quote:

---

Originally Posted by Ignatius

I'm glad that I didn't disable port 135 if the process might render my system unusable!

---

This is from GRC.

http://www.grc.com/port_135.htm

Quote:

---

Port 135 is certainly not a port that needs to be, or should be, exposed to the Internet. Hacker tools such as "epdump" (Endpoint Dump) are able to immediately identify every DCOM-related server/service running on the user's hosting computer and match them up with known exploits against those services.

---

Quote:

---

Any machines placed behind a NAT router (any typical residential or small business broadband IP-sharing router) will be inherently safe. And any good personal software firewall should also be able to easily block port 135 from external exposure. That's what you want. In addition, many security conscious ISPs are now blocking port 135 along with the notorious "NetBIOS Trio" of ports (137-139). So even without any of your own proactive security, you may find that port 135 has been blocked and stealthed on your behalf by your ISP.
Going Further: Closing port 135

The widespread exposure and insecurity of this port has generated a great deal of concern among PC gurus. This has resulted in several approaches to shutting down the Windows DCOM server and firmly closing port 135 once and for all. Although applications may be "DCOM enabled" or "DCOM aware", very few, if any, are actually dependent upon the presence of its services. Consequently, it is usually possible (and generally desirable if you're comfortable doing such things) to shut down DCOM and close port 135 without any ill effects. (The fewer things running in a Windows system, the fewer things to suck up RAM and slow everything else down.)
If you are curious about taking control of and terminating another unnecessary Windows "service", the following links will provide you with the information and instructions you'll need:

---

As it say's your ISP is probably taking care of that one..

Fwiw, another good app for showing real time TCP port connections is Active Ports. Should be able to download it from Snapfiles. It's one up on TCPview in my book because it'll give you the connecting app, for instance your webbrowser connecting on 80.

Try MS's Port Reporter if you're wanting to log all connections. Be aware though you'll be generating large log files, GB's worth of logs. MS also has an app for parsing those logs, too. Both free.

Quote:

---

Fwiw, another good app for showing real time TCP port connections is Active Ports. Should be able to download it from Snapfiles. It's one up on TCPview in my book because it'll give you the connecting app, for instance your webbrowser connecting on 80.

---

If you're running Windows XP with SP2 then I would recommend opening command prompt and issuing netstat -nab this will do the samething without downloading 3rd party software or you could go to www.foundstone.com and download fport-2.0 which does basically the same thing.

Quote:

---

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\cn22>cd c:\fport-2.0
C:\Fport-2.0>fport
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid Process Port Proto Path
1132 -> 135 TCP
1696 LEXPPS -> 1025 TCP C:\WINDOWS\system32\LEXPPS.EXE
2264 -> 1026 TCP
344 LimeWire -> 1812 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1813 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1822 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1824 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1827 TCP C:\Program Files\LimeWire\LimeWire.exe
1976 avgemc -> 10110 TCP C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
344 LimeWire -> 19945 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 45100 TCP C:\Program Files\LimeWire\LimeWire.exe
1132 -> 500 UDP
1696 LEXPPS -> 1028 UDP C:\WINDOWS\system32\LEXPPS.EXE
344 LimeWire -> 1060 UDP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1161 UDP C:\Program Files\LimeWire\LimeWire.exe
1976 avgemc -> 1831 UDP C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
2264 -> 4500 UDP
344 LimeWire -> 6347 UDP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 19945 UDP C:\Program Files\LimeWire\LimeWire.exe

C:\Fport-2.0>

---

hope this helps, cheers cn22

Thank you for the further information. By "That seems to have everything covered, doesn't it?", I meant the suggestions given thus far. I'll also disable the extras mentioned. I do have wireless at home.

I'll check out the software that various folks have mentioned.

I thought I'd seen that ISPs may also block port 135 on my behalf but I guess that if I hadn't raised the topic here, I wouldn't have received so many tips about monitoring and closing ports and also disabling services.

Quote:

---

As it say's your ISP is probably taking care of that one..

---

*Never* rely on an ISP to cover your security stance. Many still run wide open pipes. Block ports 137-139 AND 445 via a firewall of some sort (if required and/or the host is exposed to the internet). I would not attempt to shut off RPC on a win32 host unless utterly necessary. Bad things happen more times than not.

--TH13