up vote 0 down vote favorite
share [g+] share [fb]

I need a list of ports or services that face the most attacks such as ssh, telnet, ftp, etc.

I need this information for a monitoring script, not to setup security on the server.

link|improve this question
86% accept rate
What for? If you want to secure your servers, you don't allow access to ALL ports, except those that are served by your servers. – pepoluan Apr 25 '11 at 10:49
1  
@gAMBOOKa: It cannot reasonably be answered in its current form. My answer as sarcastic (all of them) and the Marco tried to redirect you to a different mind-set, but there will never be a way to answer this question with a "right" answer. – Caleb Apr 25 '11 at 11:15
3  
@gAMBROOKa: You think it would answer a lot of your questions, but the fact is it won't. It would be very deceptive to try to say that there was an answer to this, because attacks morph and scan and wait and all sorts of things. One week port 22 might get slammed, another week somebody will be scanning every port number from 1-40k and sending SIP login credentials to anything that is open. – Caleb Apr 25 '11 at 11:45
2  
Your very answer is self contradictory. If you want this for monitoring, then monitor YOUR traffic not ours. The simple answer to your question is that EVERY port you have open on YOUR network will get attacked. Monitor everything you have open. Anything port list you get from anywhere other than your open port list would be an answer not to trust. – Caleb Apr 25 '11 at 11:46
3  
It can be asnwered byl ooking at any router log. I get tons of attacks on port 80, 442 (basicalyl http / https) and 445 (ssh) as well as the 137-139 area (windows file s hares). That possibly accounts to 90% of the invalid connection attempts I am getting acording to my routers. I use this to auto-block ip's that try to reach those ports outside a fixed server list (i.e. try port 45 on any server not exposting it, my edge router does not like you for the next hour)- – TomTom Apr 25 '11 at 11:59
show 4 more comments
feedback

closed as not a real question by Chopper3 Apr 25 '11 at 11:03

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. See the FAQ for guidance on how to improve it.

2 Answers

up vote 0 down vote

1-1024

link|improve this answer
feedback
up vote 0 down vote

IMHO, you need to shutdown every port you do not need for your server/application, otherwise your server will be vulnerable as you won't pay attention to servers/daemons that you don't need but are running.

On the other hand, focus your attention on the services you really need and try to assure that they are properly configured and patched/upgraded regarding security issues.

Hope this helps!

link|improve this answer
Thank you for answering Marco. But I need the information for a monitoring script, not for configuring server security. If you have an opinion or a link to which services or ports most targeted, I'd love to hear about it. Thanks again1 – gAMBOOKa Apr 25 '11 at 11:44
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.