0

I've had a request from my customer's overzealous IT admin for ALL the servers / ports that my deployed server box (physical) uses.

It's running a debian jessie, but that should be besides the point.

Just so we're clear: they will be blocking EVERYTHING I don't specify, including security apt updates, NTP time sync, etc,. etc.

I've done some googling (hours of it), but turned up nothing.

So, is there a feasible method of finding the requested info, except for grabbing all the traffic emanating from the box for a month?

2
  • 2
    Its possible you are talking cross purposes. Tell them of the ports associated with the services it runs in addition to allowing connections initiated from the box with source ports 1025-65535 (UDP and TCP, although you will likely get away with TCP only, save for UDP on port 53). That should allow them to block inbound traffic and allow your box to make outbound requests as it sees fit. Remember to insist it requires ICMP as stupid anal sysadmins who block all ICMP break networking.
    – davidgo
    May 4 '20 at 20:03
  • Netstat -an can be useful to show what us connected/listening on your box as well.
    – davidgo
    May 4 '20 at 20:04
1

It really depends on how your server is configured.

One example is if you use a public pool of ntp servers (like 0.ca.pool.ntp.org) to sync the time with, you will find your server contacting a few IP addresses that domain resolves to with destination port as 123.

You need to resolve the address manually and add it to list of IP addresses that you should allow for outbound connections.

To get all the current established connections with the process that it is bound to, you can use the below command.

~# ss -anp
Netid     State       Recv-Q      Send-Q                                        Local Address:Port                                 Peer Address:Port
tcp       LISTEN      0           5                                                   x.x.x.x:xxxx                                      0.0.0.0:*              users:(("nrpe",pid=xxx,fd=4))

This will tell you that X process is connected to x.x.x.x IP address on Y port, this way you know what application requires what range of IP addresses to be accessed. With this list you can add the addresses you need to allow.

There is no elegant way to do this as per my knowledge, you need to collect bits and pieces of data to form this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.