2KKUU7ita

Figure 12-6:
Using
NetScan
Tools Pro to
determine
that
Slackware
Linux is
running.
Chapter 12: Linux
Countermeasures against system scanning
Although you can’t completely prevent system scanning, you can still implement
the following countermeasures to keep the bad guys from gleaning too
much information about your systems:
✓ Protect the systems with either
• A firewall, such as iptables that’s built into the OS
• A host-based intrusion-prevention application, such as PortSentry
(http://sourceforge.net/projects/sentrytools) and
SNARE (www.intersectalliance.com/projects/Snare)
✓ Disable the services you don’t need, including RPC, HTTP, FTP, telnet,
and the small UDP and TCP services — anything for which you don’t
have a true business need. This keeps the services from showing up in
a port scan, which gives an attacker less information — and presumably
less incentive — to break in to your system.
✓ Make sure the latest software and patches are loaded to reduce the
chance of exploitation if an attacker determines what services you’re
running.
233