PortSentry Errata
=-=-=-=-=-=-=-=-=

$Id: README.methods,v 1.15 2003/05/23 17:42:28 crowland Exp crowland $


This is file contains some answers to questions we've been asked, or you
may be wondering.

1) How did you pick the ports in the default .conf file?

2) Why should I be careful about running the PortSentry program?
   (PLEASE READ THIS)

Why did you pick the ports in the default .conf file?
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

There are some methods to the madness in the way ports were picked. Allow 
me to explain:


TCP Ports - Chosen for a particular interest that they pose to an attacker.
These ports are generally the most likely to be abused by a person seeking
to gain access to a host. 

Low Range - Ports: 1-20

These ports are chosen for two specific purposes:

1) Because some scanners do sequential scanning starting at 1 and working
up. This will allow the PortSentry to respond rapidly to a scan before any real 
services are revealed.

2) Several of these services (systat, netstat) are used by attackers as recon
mechanisms and are frequently looked for when they are performing a targeted
non-sequential port sweep.

Low-Mid Range - Ports: 20-500

These ports contain a large number of services that are very commonly
looked for by attackers. Some of these services can be used for recon
purposes or for full remote access.

Mid Range - Ports: 500-1024

These ports contain a host of services commonly looked for by attackers (rsh,
rlogin, rexec, mountd). 

Mid-High Range - Ports: 1024-32768

These ports contain a wealth of services such as X-Windows, IRC servers, 
router serial ports, MUDs and others. One particular port (31337) is
sometimes used as a backdoor, and is used by the program "netcat" to 
facilitate UDP (yes that's UDP) scanning of the target host. 

High Range - Ports 32769-65535

These ports are generally not used, with the exception of a really nasty bug
in Solaris in which the portmapper service (normally on port 111) would
present a copy of itself listening in the 327XX range of ports. This allows
an attacker to use a modified portmapper probe to hop filters and dump
RPC services on the target. Some scans target this range specifically.
The port 49724 is used by the scanning tool "nmap" to do UDP scanning
much like netcat as well. 

-------------------------------------------------------------------------------

UDP Ports - These ports harbor a large number of services (largely RPC related)
and have become the frequent target of "stealth" RPC scanning in which the
attacker attempts to locate RPC services manually instead of using
portmapper. This prevents notification of admins of unauthorized use
of the portmapper, a feature found in Wietse Venema's portmapper version.

Low Range - Ports: 1-20

As above, some scanners do sequential scanning starting at 1 and working
up. These ports will allow the PortSentry to respond rapidly to a scan before 
any real services are revealed.

Low-Mid Range - Ports: 20-500

TFTP(69), SNMP(161,162), and SMB(137,138) are commonly sought ports in this
region for the information and compromise potential they provide.

Mid Range - Ports: 500-1024

A large number of RPC services are located in this area. Some attempts
to do "stealth" RPC scanning concentrate a UDP scan in the 500-700
range. This will allow admins to get notification of this activity.

Mid-High Range - Ports: 1024-32768

NFS (2049) is the main problem here, along with some RPC services and
Back Orifice (31337).


High Range - Ports 32769-65535

These ports are generally not used, again though, Solaris has a habit of 
concentrating services in the 327XX range. Waiting here for connections
will find people probing for these services quickly. People shouldn't be 
here unless portmapper sent them, and since we don't register with 
portmapper they shouldn't know about us unless they are up to no good.


Why should I be careful about running the PortSentry program? 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Because you have the potential of presenting information to an attacker
that may tempt them to return at a later date. If you show a person
a load of ports open then it may pique their curiosity. If they return
they may find a real problem with your system that the PortSentry cannot
defend. Additionally you may do something un-professional like present
a banner to them that says "You k-rad HaX0r d00d you'll NeVEr brek
r00t heRe!!" and this then makes it a challenge. This is something 
to consider. 

With UDP/stealth scan detection, there is the possibility that an
attacker can flood your host with bogus packets causing PortSentry to
continuously activate and write out warnings to your log. This can create
a denial of service attack that you should be aware of. We do not recommend 
running UDP/stealth scan detection on an Internet host that is
high-profile and subject to frequent abuse. 

It is our experience though that spoofed scans are not an issue and we
recommend people use auto-blocking knowing that %99.9 of the time it 
will block a scan. If you run into a denial of service problem on 
your host, just go back to "classic" TCP mode and the problem will go away.

Again though, we strongly feel that the benefits of blocking hosts 
*far outweighs* the limited risk you take by having auto-blocking turned on.

