Re: [gentoo-hardened] Ports, protocols, and services

[ascii]

Otin, Jean-Paul F. wrote:
> Output from nmap, lsof, and sockstat run against a Gentoo Linux system
> would be helpful.

i think this is stuff indipendent from the distribution, anyway:

sudo netstat -anp | grep ' LISTEN '

will give you listen sockets associated to pid

sudo netstat -anp | grep ' LISTEN ' | sed 's/  */ /g'

makes this computer readable

excuse me for the >900 chars oneliner : )

time sudo netstat -anp | grep ' LISTEN ' | sed 's/  */ /g' | php -r
'echo "<!-- credits/spam: Francesco <ascii> Ongaro, http://www.ush.it/
-->\n"; $s = trim(file_get_contents("php://stdin")); $s = explode("\n",
$s); $p = trim(shell_exec("ps aux | sed \"s/  */ /g\"")); $p =
explode("\n", $p); $pc = count($p); foreach ($s as $l) { $cmd = "NULL";
$a = explode(" ", $l, 7); /*print_r($a);*/ list($pid, $name) =
explode("/", $a[6], 2); $name = trim($name); for ($i=0; $i<$pc; $i++) if
(substr($p[$i], stripos($p[$i], " ")+1, strlen((string)$pid)) == $pid)
$cmd = $p[$i]; $spid = (int)intval($pid); $pstree =
trim(shell_exec("pstree -aAclpu $spid | sed \"s/|-/ /g\" | sed \"s/\`-/
/g\" | sed \"s/|/ /g\"")); $lsof = trim(shell_exec("sudo lsof -np $spid
| grep -v \"COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME\" | sed \"s/
 */ /g\"")); echo "<p>\n <name>$name</name>\n <pid>$pid</pid>\n
<listen>{$a[3]}</listen>\n <cmd>$cmd</cmd>\n <pstree>$pstree</pstree>\n
<lsof>$lsof</lsof>\n</p>"; }' > report.xml

gives you a nice "xml" file with lsof and pstree of each listening
process (only the listening pid not his childs)

naturally this could be improved but you haven't specified your final
scope so i stop here

if you are using grsec proc restrictions you could have to call pstree
with sudo, else this should work from non-root user using sudo when
needed

regards, Francesco 'ascii' Ongaro
-- 
gentoo-hardened@g.o mailing list