Ports question

[vbfanforlife]

Hello:

It came to my attention that port 3306 was open on my box, so I closed it in my.cnf, but now I have another issue, which I'm hoping someone can help with...

I have two sets of nameserver IPs. My wife's IP's show up as nameservers under "IP administration", that is the ns.domain.com shows up under the nameserver column. Mine don't, but they function, and pass DNS tests. Is this a major issue?

Also, scanning my ports shows that I have ports 21, 25, and 80 open on the nameserver IP's. How would I go about closing these ports, since they are reserved specifically for nameserver use?

Thanks!

 

[chatwizrd]

Dns only uses port 53 tcp and udp.

21 = ftp
25 = smtp
80 = http

Since by default all these ports bind to all ip addresses on the machine you would have to edit each config file for the services to make sure they bind to only the ips you want or else firewall the ports from the ips you dont want them to listen on.

As far as the nameserver issue I have no clue what you are talking about with that.

 

[vbfanforlife]

Dns only uses port 53 tcp and udp.

21 = ftp
25 = smtp
80 = http

Since by default all these ports bind to all ip addresses on the machine you would have to edit each config file for the services to make sure they bind to only the ips you want or else firewall the ports from the ips you dont want them to listen on.

As far as the nameserver issue I have no clue what you are talking about with that.

LOL, well first with the nameserver issue, see the attached screenshot. She has it filled in, I don't.

As for the service config files, then where would I find the config files to edit
services for HTTP, FTP, POP, SMTP? I don't think it's a security issue to have these open on the nameserver IP's, but it would just close extra doors.

 

[vbfanforlife]

Oh, also, a port scan shows that port 53 is closed, but yet my nameserver IPs function????

 

[chatwizrd]

Dns uses port 53 udp mainly.

 

[vbfanforlife]

Okay, so it's no worries that port 53 shows closed?

Then, I guess the issue is is it a major security issue that the POP/SMTP/FTP/HTTP ports are open on the nameserver IP's? I don't assign websites to these anyway, so methinks it'd be a lot of hassle for no real reason to close up these ports?

 

[avaz]

Just use a firewall to restrict access to those ports.