Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A friend of mine gives me a (user) ssh access on an ec2-instance (ubuntu) that he's got. So, for reason that now I don't know, in the future I will have need of an open tcp port over the firewall to make listening some sort of service (like http or other). I don't want to stress him every time that I need a tcp open port in the firewall but, meanwhile, I don't want to leave open (and vulnerably unbinded) a port on his firewall. The question is: is there a way to fake bind (in the way that this fake service occupy) this tcp port? Or is there another "pattern" to accomply this issue?

share|improve this question
2  
What makes you think an open and unbound port is less secure than one with a stub daemon attached? The former just gives a quick and simple TCP reset, while the latter can be vulnerable to all sorts of interesting attacks if wrongly coded. –  MadHatter Oct 10 '12 at 14:34

1 Answer 1

up vote 1 down vote accepted

If you really want to do it like that, possibly the easiest way would be using the discard service which is a xinetd builtin service. This service is pretty much a /dev/null for networking. However, even having an infinitely huge data landfill doesn't make sure that xinetd is working correctly.

Probably more secure would be using a proper iptables rule in your Ubuntu box until you really set up the service. This would be just a iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset.

My pesonal opninion is keeping those rules at the edge of your network, but thinking of similar experiences with... colleagues... I can understand your motivation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.