0

On a brand new install of Windows 2008 core (for use as a hyper V host( There are 4 ports open to the world:

135/tcp   open  msrpc
445/tcp   open  microsoft-ds
2179/tcp  open  unknown
49154/tcp open  unknown

I tried blocking one of them with the rule netsh firewall delete portopening protocol=TCP port=135

But nmap -PN still shows it as open! I am a lot more experienced with Linux, so I am not sure if these ports are a security risk or not, but I would rather close them to the world. How can these ports be blocked using netsh advfirewall firewall ?

To expand on this further, what are the most locked-down firewall rules that can be put in place to allow remote management using server manager, and hyper V manager, from a single trusted IP address. To put it another way, I want to manage these new servers from a single remote machine, and allow no access to anyone who is not using that IP.

2
  • is this in a domain based enviro?
    – tony roth
    Jun 15, 2012 at 16:32
  • @tontroth No it isn't, I am now able to access the server using my management server (same credentials) but there is no domain controller where the new servers are getting installed, just straight to internet.
    – Rqomey
    Jun 15, 2012 at 16:41

2 Answers 2

2
  1. Pull the network cable out. I'm sure the RPC service is much more secure than it used to be but having ports 135 and 445 open to the world would make anyone who had to deal with the Blaster and Sasser worm more than a little nervous.

  2. Set the firewall to block everything inbound.

  3. Only allow the traffic you want, from the IP addresses you want it from.

Better yet, put a hardware firewall in between that server and the Internet.

5
  • Thanks Chris! Yea 2008 seems to have about 60 firewall rules (each service seems to have a rule even if it's sharing a port. I think I'll have to go through them all.
    – Rqomey
    Jun 16, 2012 at 14:39
  • @Chris_McKeown Is it better to set a global rule saying block everything inbound, or should each of the (approx 60) active rules be changed (in the scope section) instead?
    – Rqomey
    Jun 18, 2012 at 8:59
  • Is a hardware firewall out of the question? Even a basic NAT router/firewall would make things easier. Jun 18, 2012 at 9:07
  • I have requested it, but due to the nature of the company, once a decision is made it is rarely changed. Also a firewall may be regarded as a single point of failure, so that brings it's own problems.
    – Rqomey
    Jun 18, 2012 at 9:10
  • Update: I manage to convince the company to create an internal only network for management. Before this I had gone through each firewall rule and set the scope remote IP (This was done using the remote management console) to the management address, and this seems to have worked.
    – Rqomey
    Jun 19, 2012 at 7:35
0

Instead of using the tools remotely, consider using them locally from the server. And access the server via RDP. it only needs a single port (3389) open and will let you remotely manage the VMs the same as you would locally on your box. I find the performance almost the same and for the most part unnoticable. (assuming your internet connection isn't dialup, in which case, remote management would suck too).

2
  • Hi mike! It's actually 2008 core so it's just a basic command line, no ui at all, so it can't really be managed through rdp unfortunately
    – Rqomey
    Jun 16, 2012 at 14:35
  • I totally missed that! IN that case, Chris' suggestion of blocking everything and opening up only what you need from that single IP is the way to go.
    – MikeAWood
    Jun 18, 2012 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .