From owner-freebsd-security  Tue Mar 19  7:16:36 2002
Delivered-To: freebsd-security@freebsd.org
Received: from chaos.evolve.za.net (chaos.evolve.za.net [196.34.172.107])
	by hub.freebsd.org (Postfix) with ESMTP id BEE7A37B404
	for <freebsd-security@freebsd.org>; Tue, 19 Mar 2002 07:16:21 -0800 (PST)
Received: from [192.168.0.56] (helo=DAVE)
	by chaos.evolve.za.net with smtp (Exim 3.34 #1)
	id 16nLKP-0009X8-00; Tue, 19 Mar 2002 17:15:09 +0200
Message-ID: <001b01c1cf58$458facc0$3800a8c0@DAVE>
From: "Dave Raven" <dave@raven.za.net>
To: "Julian Stacey" <jhs@bim.bsn.com>, <freebsd-security@freebsd.org>
References: <200203191511.g2JFBbG55810@jhs.muc.de>
Subject: Re: 	ports 1021 1022 1023 & 587 ?
Date: Tue, 19 Mar 2002 17:10:40 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

sockstat

----- Original Message ----- 
From: "Julian Stacey" <jhs@bim.bsn.com>
To: <freebsd-security@freebsd.org>
Sent: Tuesday, March 19, 2002 5:11 PM
Subject: ports 1021 1022 1023 & 587 ?


> On a 4.5-RELEASE firewall ports 1021 1022 1023 are shown open by
> /usr/ports/security/portscanner, but not listed in /etc/services.
> 
> Are they daemons doing auto decrement allocation from 1024 ?
>   ( I'm using ipfw firewall, not using diverts (yet), not using X server,
>   am using various other daemons inc. nfs amd lpd timed whod etc)
> 
> Should I block some 1023 port range with ipfw on non {localhost & local
>  ethernet} interfaces ? What range ?
> 
> submission=587 is also open.
> 
> Could someone please remind me the name of a command to back trace
> the port to whatever's opened it ? Would it be a good idea to add
> a commented hint at entry 1023 of /etc/services ?
> 
> Julian Stacey Munich Unix (FreeBSD, Linux etc) Independent Consultant
> jhs@bim.bsn.com Free software:  http://bim.bsn.com/~jhs/free/
> Ihr Rauchen = mein allergischer Kopfschmerz !  Schnupftabak probieren !
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message