up vote 1 down vote favorite
share [g+] share [fb]

I have a web server/database/domainController. I notice that ports 137 and 138 on the public IP AND private IP are open on all machines there are also other open ports on 0.0.0.0.(ie. 135, 2002)

Can and should I close 137-139 on the public IP only? will that interfere with any services.

link|improve this question
57% accept rate
feedback

2 Answers

up vote 1 down vote accepted

Listening services should be explicitly enabled not implicitly as is the case with core services on most servers. If you don't need ports 137,138, etc then disable the services so they aren't listening. Google "disable netbios over tcp". You can disable netbios services on a per Network Adapter basis. So disable them on the WAN for sure.

First google result:

http://www.petri.co.il/disable_netbios_in_w2k_xp_2003.htm

Also, as was stated previously you should only listen publicly on your webserver and only on those ports you are actually using. Use the windows host-based firewall to drop everything except tcp requests to http(80), https(443), DNS(53)(UDP).

Also, is this internal network solely your own? If it is shared with other "dedicated" server customers or other departments you may wish to limit access by source IP on the internal interface to any netbios, core windows services.

link|improve this answer
By network adapter yo mean the "interface type" option ("remote access") or somewhere else? – zsharp Feb 8 '10 at 4:20
It sounds like you have two network interfaces (NICS), one being a WAN for public access to the server, and one being a LAN for internal communication between your servers. The listening ports 137,etc can be disabled/enabled on a per NIC basis. The link I included will walk you through disabling them for your WAN NIC. The steps are more or less similar for 2k8. – CarpeNoctem Feb 8 '10 at 4:28
i disabled for wan, but what about lan with active directory? DO I need Netbios for ACtive Directory? Ports 137-9 in the windows firewall were automatically opened upon installation of AD. – zsharp Feb 8 '10 at 5:24
I am not a NetBIOS guru but you most likely should leave them open if you are using AD. They are used for WINS as well as NetBIOS (I believe). hostname resolution and the other services that use NetBIOS and WINS will probably be used for mapping drives and the like. You can always limit which servers on the lan have access to those ports by using the source IP filterings available within the host-based windows firewall. – CarpeNoctem Feb 8 '10 at 5:36
You can absolutely disable NetBIOS (and it's recommended as modern TCP/IP networks will use DNS for name resolution), but check for any old network printers or if you have Win95/98 machines and/or any old hardware that may rely on it. You can use a Vendor Class in MS DHCP to disable NetBIOS over TCP (and you can easily do it via a GP script; google it). – gravyface Apr 10 '10 at 13:06
feedback
up vote 1 down vote

This is based purely on the info you've given and I can't cater for things outside of your description as it stands:

You should lock down the external interface so that the only machine with outbound access is the web server, on ports 80 and 443 (if you serve SSL pages)

If you internal AD DNS needs to resolve external DNS entries you may also need to open port 53 between it and the web.

For clarification: are you talking about lock-downs in place on the Windows firewall itself? If so, check the settings on the hardware firewall between these servers and the internet link. That's the most common place to lock down network traffic, and you don't need to duplicate those rules on the local boxes.

To be clear though, you should absolutely restrict internet access on ports 137-139. Check port 445 as well!

link|improve this answer
windows firewall only. on the webserver, it doesnt matter that the private ip (192.X>X>X) has these ports open correct? – zsharp Feb 8 '10 at 3:36
Almost always true, but this depends on how the network is configured. If there's a device on the edge of your network that is NATing through to that internal IP, you can still be compromised without a public IP bound locally on the box. – Chris Thorpe Feb 8 '10 at 4:14
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.