[CentOS] Port 631 closed, not hidden

[mouss]

Miark wrote:
> On Thu, 22 Nov 2007 00:47:08 -0800, John wrote:
> 
>> Miark wrote:
>>> I have the firewall turned on my CentOS 5 box, but GRC is
>>> reporting that 631 is closed instead of stealthed. If the
>>> firewall isn't configured to allow that, then why might that
>>> be happening?
>>>   
>>
>> that GRC port scanner is not something I'd rely on.     use a
>> shell account somewhere, and nmap to portscan yourself.
> 
> I did that, too. 631 is actively rejecting instead of dropping.
>  
>> anyways, WTF 'stealth' ?    ports are SUPPOSED to return
>> "NAK" ... IMHO, 'stealth' is complete and total BS, dropping
>> request packets does nothing useful.
> 
> You don't think it helps to push scanning goons on to some other
> server? 

If I attack your machine, whether a port discards packets or send me an
RST is more or less irrelavant: this is a port I won't use, I'll go try
the next one.

A honeypot is more efficient (against the attack). you can also use
"recent" to block list scanners.

> Or to prevent any sort of attack? 

well, it's a kind of security by obscurity, so there are tradeoffs. you
possibly make it hard for miscreants (for script kiddies really, not for
"professionnal miscreants"), but you certainly make it hard for honest
people. connection troubleshooting becomes hard or even impossible.

While I am in, some people block all icmp traffic. I personally consider
such hosts as diconnected and their IPs as hijacked (subject to block
listing).

> It seems logical to me
> that dropping is less work for the box than doing anything
> else. (?)

If you return an RST, the client stops. if you drop, the client will
retransmit. so you get more traffic (you send less, but you receive
more). The difference is however ridiculous.