Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I hide version of Linux I am running when I scan server ports?

When I nmap'ed (nmap -A -T4 192.168.40.12) the server's ip from the outside, this is the result:

Starting Nmap 4.62 ( http://nmap.org ) at 2009-11-07 11:27 IRST
LUA INTERPRETER in nse_init.cc:763: /usr/share/nmap/scripts/robots.nse:4: module 'http' not found:
 no field package.preload['http']
 no file '/usr/share/nmap/nselib/http.lua'
 no file './http.lua'
 no file '/usr/local/share/lua/5.1/http.lua'
 no file '/usr/local/share/lua/5.1/http/init.lua'
 no file '/usr/local/lib/lua/5.1/http.lua'
 no file '/usr/local/lib/lua/5.1/http/init.lua'
 no file '/usr/lib/nmap/nselib-bin/http.so'
 no file './http.so'
 no file '/usr/local/lib/lua/5.1/http.so'
 no file '/usr/local/lib/lua/5.1/loadall.so'
SCRIPT ENGINE: Aborting script scan.
Interesting ports on 192.168.40.12:
Not shown: 1710 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 3.9p1 (protocol 1.99)
53/tcp   open  domain  dnsmasq 2.47
80/tcp   open  http    Apache httpd
222/tcp  open  ssh     OpenSSH 3.9p1 (protocol 1.99)
8081/tcp open  http    CherryPy httpd 2.3.0
MAC Address: 00:10:F3:0F:59:B7 (Nexcom International Co.)
Device type: firewall
Running: IPCop Linux 2.4.X
OS details: IPCop firewall 1.4.10 - 1.4.15 (Linux 2.4.31 - 2.4.34)
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.180 seconds

I do not want the OS details to be shown. I am using an IPCop firewall.

Thanks.

share|improve this question

2 Answers 2

nmap guesses the OS running on the target host by using (among other things) the characteristics of the TCP/IP stack. You can not prevent that except you change the way the TCP/IP stack of Linux works.

Details to nmap's OS detection:

Additionally the README file of the passive OS fingerprinting tool (p0f) could also give you a clue on how this works.

share|improve this answer
    
I did add one line in sysctl.conf (/etc/sysctl.conf). net.ipv4.ip_default_ttl = 199. When i nmap'ed (nmap -A -T4 192.168.40.12) the server's ip from the outside, in result not show linux version. –  M.Rezaei Dec 13 '09 at 8:09
up vote -1 down vote accepted

I modify /etc/sysctl.conf

and add the following line:

net.ipv4.ip_default_ttl = 199

save/exit

share|improve this answer
2  
This is classical "Security through obscurity" –  Anonymous Dec 22 '09 at 13:27
    
@Anon - Exactly. @M.Rezaei -- this gains you nothing if your intent is to secure this host. It doesn't address any vulnerability of the system, and further, gives you a false sense of security. –  romandas Apr 9 '10 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.