firewalls for newbies

hello all

i have been doing alot of research recently on firewalls and ports...being a newbie myself to security...so heres some basic steps to securing your system

firstly install a firewall i recommend agnitum outpost.... but if your a total newbie to firewalls like i was i found zonealarm to be pretty much idiot proof and a good starting point easy to configure etc goto www.zonelabs.com for zonealarm (cant remeber exact address for agnitum just do a goggle)

i would also recommend diableing file sharing goto control panel ->network connections >choose connection-> right click-> then propties-> then at the top networking->uncheck file/printer sharing(maybe even uninstall it if your not gonna need it)

also goto a dos prompt ie c:

in win xp goto start-> run-> type cmd
in win 95/98 me goto msdos prompt

then type netstat -a

this will give you a list of all ports and what they are doing
ie listening ,connected etc

so u can see what program are connecting using what port

hopefully this is some help to you fellow security newbies

waterboy

You can use netstat -an to get the IP's you are connected to.

If you like to monitor the connections you make in a certain period you could use :
netstat -an 3 >> c:\connections.txt
and then filter the output by using:
find /I "established" c:\connections.txt

Note that the setting of 3 (seconds) will fill a log rapidly and it will downgrade your system a bit.

If you would like to read even more visit these threads:
Securing your box
http://www.antionline.com/showthread...hreadid=237724
Tutorials index
http://www.antionline.com/showthread...hreadid=133897

To monitor ports/connections and their associated applications, you can use fport or tcpview . Fport is executed from a command prompt once installed. However, tcpview uses a GUI to give you real-time information on the applications in use with what ports. They have many other tools on both sites. I would highly recommend them both to Newbies and Oldheads alike. Although piping a netstat to a file and filtering is very intuitive. Great posts gang! ;)


t2k2


Edit: I hear that Tiny Personal Firewall is pretty good also. You can find it here.

:rolleyes: hey i recommend two firewalls which is sygate go do a google search if u go on download.com it wont work seems to be virus messed and also agnitum outpost FREE firewall
sygate is free now that is better then zone alarm man you get more idea even a rook would under stand it.

You could also use the program Active Ports, its just a GUI based alternative to fports. Download it from here:

http://www.winportal.com/file.asp?ObjectID=4712

And here is a description:

Quote:

---

Active Ports - easy to use tool for Windows NT/2000/XP that enables you to monitor all open TCP/IP and UDP ports on the local computer. Active Ports maps ports to the owning application so you can watch which process has opened which port. It also displays a local and remote IP address for each connection and allows you to close any port. Active Ports can help you to detect trojans and other malicious programs.

---

I used Agnitum's Outpost firewall and loved it. Unfortunately, it isn't compatible yet with ICS. The version 2 is supposed to correct that, if it ever makes an appearance. When we networked our computers here, I tried several firewalls, ZoneAlarm, Tiny, and Look and Stop Lite before settling on Sygate. For me, Sygate is by far the best software firewall available for ease of use. We now work through an old 486 box running Slackware Linux, which I think is much safer, considering we're connected 12 to 14 hours a day.

OpenBSD with packet filtering and authpf.. :D

HELP ME !!!!!

I'm new ( only registered today !! ) and i have a problem....

I've been using a chat station by Lycos from my office machine for months with no problems, now all of a sudden, the Firewall is blocking my access into the site. I cant approach the network administrator for obious reasons and need some advice.

i can still get on to warez.com and such like sites,

Shy

well shy look at it like this... using your office machines to chat when you should be working is generally frowned on by most UK bosses. The sysadmin at your place may be a little pissed if you're using machines under his/her care for your own purposes during working hours (remember they are not YOUR resources, they are the companies)... and has thus blocked access to the chat program.

if you're only using it through your lunch break etc then I don't see a problem with you asking the sysadmin to unblock access... why can't you ask your sysadmin? Is he/she really that much of an ogre?

No one here is going to tell you how to bypass the company firewall and i certainly won't - the best thing for you to do is talk to the sysadmin and be real nice to them or just grit your teeth and learn to live with it. Remember it's abuse of company resources that leads to situations like this.

Z

warez.com ? what kinda stuff do they have there ?

surely if you appeal to the admin and say "well warez.com is ok, then why not chat ?"

he/she will say.. " yeah warez is ok so chat must be ok too "

*sigh

I wonder what the Bastard Sys Admin from Michigan would do to this "shy32" character if he were to catch him/her using a chat program on one of his computers during company time.....//thinkz.....even more interesting is what would happen if the sys admin were to find out that this person had been visiting warez! I'd love to see the reaction to that one! (Warez is not the *ahem* best site to visit while at work)....

That is a very scary thought ::hide-beh looks for Gore I think it is safe.

Quote:

---

Originally posted here by keezel
I wonder what the Bastard Sys Admin from Michigan would do to this "shy32" character if he were to catch him/her using a chat program on one of his computers during company time.....//thinkz.....even more interesting is what would happen if the sys admin were to find out that this person had been visiting warez! I'd love to see the reaction to that one! (Warez is not the *ahem* best site to visit while at work)....

---

Oh yea, I definitely think this is a job for the Bastard System Admin from Michigan....

Someone find Gore and get him in here!

This is perfect material for his next BOFH story.....:D

ROFLMAO... I did consider seeing if we could get Gore to reply to this guys request... then I thought..... no I'll be kind I'll not bring this to Gore's attention..... but yeah it would be fun to watch...


Z

You sound like a sysadmins nightmare....If I was him, I'd be blocking all warez sites as well as chatting....

If you really wanted to start chatting, you gotta find some way to get into the router configuration; depending on the size of the company it should be pretty easy....find the gateway and check it out; start with obvious passwords, 1234, admin, Administrator, <admin's name> etc. then find out which ports your chatting agent uses via netstat -an, then open up the ports on the router....

Of course the hard part is getting the password....lol...

If your chat program is being blocked its because of thermo neclear bio stress on your RAM chips cause by to much use and not enough Reliefe sessions.

If you have RAM card reliefe rod you should be fine. Just set them up and use the rod a few times. If you dont have one, youll have to get a nail gun and or a paper clip. Its just like when a sidewalk or porch gets a crack in the cement from stress. Take the nail gun and put one shot threw the MIDDLE of the HD. Make sure its the middle because otherwise itll ruin the machine. Also take the ram cards and de staticise them. If you have something like sox on your feet, run across some carpet for a few minutes while you let the static build up, then open your machine and pull out the RAM cards and push them back in repetedly for about 3 minutes. After this your cards will be fine and you can chat again. So all thats left is to stick a paper clip into the running machine's power supply. If it sparks dont worry, they are built for this. Just make sure to have nothing on your hands. have a nice day.


Its like that Ramone's song "gimmie gimmie shock treatment" All users do well from some electricity.