There are of course other tools that may be extremely useful when debugging your
firewall scripts. This section will briefly touch the most common tools used to
find out fast how your firewall looks from all sides of it (inside, outside,
etc). The tools I have chosen here are the nmap and nessus tools.
Nmap is an excellent tool for looking at the pure firewall perspective, and to
find out which ports are open and more low level information. It has support for
OS fingerprinting, several different port scanning methods, IPv6 and
IPv4 support and network scanning.
The basic form of scanning is done with a very simple commandline syntax. Don't
forget to specify which ports to scan through with the -p option, for example -p
1-1024. As an example, take a look below.
blueflux@work3:~$ nmap -p 1-1024 192.168.0.1
Starting nmap 3.50 ( https://www.insecure.org/nmap/ ) at 2004-03-18 17:19 CET
Interesting ports on firewall (192.168.0.1):
(The 1021 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
587/tcp open submission
Nmap run completed -- 1 IP address (1 host up) scanned in 3.877 seconds
It is also able to automatically guess the operating system of the scanned host
by doing OS fingerprinting. Fingerprinting requires root privileges though, but
it may also be very interesting to use to find out what most people will think
of the host. Using OS fingerprinting may look something like the example listing
below.
work3:/home/blueflux# nmap -O -p 1-1024 192.168.0.1
Starting nmap 3.50 ( https://www.insecure.org/nmap/ ) at 2004-03-18 17:38 CET
Interesting ports on firewall (192.168.0.1):
(The 1021 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
587/tcp open submission
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux Kernel 2.4.0 - 2.5.20
Uptime 6.201 days (since Fri Mar 12 12:49:18 2004)
Nmap run completed -- 1 IP address (1 host up) scanned in 14.303 seconds
OS fingerprinting isn't perfect, as you can see, but it will help narrow it
down, both for you, and for the attacker. Hence, it is interesting for you to
know as well. The best thing to do, is to give as little material as possible
for the attacker to get a proper fingerprint on, and with this information you
will know fairly well what the attacker knows about your OS as well.
Nmap also comes with a graphical user interface that can be used, called the
nmapfe (Nmap Front End). It is an excellent frontend of the nmap program, and if
you know that you will need a little bit more complicated searches, you may wish
to use it. For an example screenshot, take a look below.
Of course, the nmap tool has more usages than this, which you can find out more
about on the nmap homepage. For more information, take a look at the Nmap resources.
As you may understand, this is an excellent tool to test your host with, and to
find out which ports are actually open and which are not. For example, after
finishing your setup, use nmap to see if you have actually succeeded in doing
what you wanted to do. Do you get the correct responses from the correct ports,
and so on.
While nmap is more of a low level scanner, showing open ports etcetera, the
nessus program is an actual security scanner. It tries to connect to different
ports, and to find out at most, what kind of version the different servers are
running. Nessus takes this a step further, by finding all open ports, finding
out what is running on that specific port, what program and which version is
running, and then testing for different security threats to that program, and
finally creating a complete report of all the security threats that are
available.
As you can understand, this is an extremely useful tool to find out more about
your host. The program is built up in a server client way, so it should be
fairly easy to find out more about your firewall from the outside by using an
external nessus daemon, or internal for that matter. The client is a graphical
user interface where you login to the nessus daemon, set your settings, and
specify which host you would like to scan for vulnerabilities. The generated
report may look something like in the example below.
 | Nessus should be used with some caution however, since it can crash a machine
or a service that it is specified to attack. Those attacks that risk crashing a
machine are per default turned off luckily.
|
