How to install and secure egroupware - Directory UMM

Conclusion:
Minimum necessary open ports (non-SSL): 22, 80, 443
Maximum necessary open ports (including E-Mail server): 22, 25, 80, 110, 143, 443, 465, 993, 995
Recommended minimum (SSL only, no E-Mail server): 22, 443
Recommended maximum (SSL only, E-Mail server): 22, 25, 443, 993, 995
6.1.1.2 The portscanner
There are several tools available that will allow you to check your installation against open ports. One that is
available under both *NIX and Windows Is Nmap, which can be found at: http://www.insecure.org/nmap.
Install Nmap on your machine and check your server against open ports.
6.1.1.3 Output from a portscanner
Here is example output from a Nmap scan against a server. Nmap shows you the ports which are open to
connect to on this server.
[root@server root]# nmap -sV yourserver.com Starting nmap 3.45 ( http://www.insecure.org/nmap/ ) at 2003-09-17 00:48 CEST
Interesting ports on xxx.xxx.xx.xxx:
(The 1651 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.1p1 (protocol 2.0)
80/tcp open http Apache httpd 1.3.27 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.12
OpenSSL/0.9.6b PHP/4.1.2 mod_perl/1.26)
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
443/tcp open ssl OpenSSL
Nmap run completed -- 1 IP address (1 host up) scanned in 23.000 seconds
6.1.1.4 Disabling unneeded services/servers
If Nmap found services running on your server that you do not need, stop them. After you restart the service
should not automatically start again.
On a Red Hat installation you can use the following commands to stop and disable a service:
[root@server home]# service name_from_the_service stop
[root@server home]# chkconfig –level 345 name_from_the_service off
On a Debian-based installation you can use the following tools:
Reiner Jung Install and Secure eGroupWare Page 21 of 67