Knoppix Security

**rickenbacherus** · 05-26-2003, 08:53 PM

Originally Posted by Tortoise

Forgive my ignorance, but doesn't your security in this scenario stem partly from the faxt that if you have no read / write storage you don't have anything to steal?

Exactly. The first step however is remaining invisible or at least as invisible as you can. Likely you will want to run some service or another and must show a port as closed but for any ports you're not using stealth is the way to go man.

Secondly- you need to keep them out- step in ipchains (old firewalling) or iptables (new firewalling). I use ipchains because 1)They work. 2) I understand them better than iptables. 3)My router distro is incapale of using iptables. (Although I have been looking very hard at LEAF lately which is based on 2.4 kernel and iptables).

As I posted above- I would really love to see some scans on your average home users router. Not just a quickie "most common" ports scan either- the full enchilada- all 65535 ports. Not to brag that "my router can beat up yours" but to have a genuine basis on which to make a decision.

Argument#1- "My router has a nice GUI I use through my web browser- it's so cool!" Yeah and it's another port open too. I use ssh- it's secure, it requires a password AND a key signature. I also have an easy to use menu.

Argument#2- "My router is small, cute and fuzzy.." Yeah they are but if you're handy you could make a pc smaller AND you can get one for free.

Argument#3- "My router uses almost no electricity-my electricity company loves me." Same here- no CPU fan, no case fan, no fans at all- I've even modified the power supply- it doesn't have a fan either. Of course I wouldn't recommend trying that unless you know what you're doing.
Besides- if you were really that energy conscience you'd shut off your air conditioning and go soalr.

There are 65535 ports that can be opened. Therefore we must conclude that there are 65535 ports that can be scanned, probed and penetrated. That doesn't sound very pleasant does it? All of those freeware wimpdoze apps that everyone seems to love so they can swap music files open their own port- yeah that's right, they open their own port! There is nothing on my system that is even capable of doing that- If I don't open the port it doesn't get opened-period.