Topic: Opened ports

[Palani]

I went to http://scan.sygate.com/prequickscan.html to have a scan done on my SME Server. The results are below:

SMTP 25 OPEN SMTP is used to send email across the internet. This allows an attacker to verify user accounts on your system, send anonymous (spam) email, or even access files on your hard drive.
IDENT 113 OPEN Ident is often used for IRC (chat), but also provides information about your system and who is using it
HTTPS 443 OPEN Secure Web Servers are often used by banks and online vendors
ICMP  8  OPEN An ICMP ping request is usually used to test Internet access. However, an attacker can use it to determine if your computer is available and what OS you are running. This gives him valuable information when he is determining what type of attack to use against you.

All other ports were Stealthed/Blocked.

Should I be worried about any of this. I know SME is a secure server and all but was just wondering.

Note: I also went to grc.com and had the same like results.

Thanks
Palani

[Bill Talcott]

If you want to receive mail, you need port 25 open. While there is a command to verify users, I remember reading somewhere that most servers will respond with the same answer whether or not it's a valid user, so that might not even be an issue.

> SMTP 25 OPEN SMTP is used to send email across the internet.
> This allows an attacker to verify user accounts on your
> system, send anonymous (spam) email, or even access files on
> your hard drive.

Note that with SME, external access to SMTP is disabled unless you get Damien Curtain's addon and the user logs in with a valid username and password. It can't be used for spamming in the default configuration.

Ident is used to verify info for some connections. There have been a bunch of threads on it. If you stealth the port, some connections will be delayed until the attempt times out, or it will just fail completely. If I remember correctly, it doesn't give any really valuable info anyway.

If you want secure connections, you need HTTPS. That's what's used for Server Manager by the way.

Yes, they can probably figure out what OS you have by the ping response. Again, probably not really giving away anything too amazing...