Thursday, December 13, 2007

Securing Eee PC




If you don't know how to install & configure a firewall, at least do the following:

In Easy or Full Desktop mode,
/home/user> netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:netbios-ssn *:* LISTEN
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 localhost.localdoma:ipp *:* LISTEN
tcp 0 0 *:microsoft-ds *:* LISTEN
udp 0 0 eeepc-m:netbios-ns *:*
udp 0 0 *:netbios-ns *:*
udp 0 0 eeepc-m:netbios-dgm *:*
udp 0 0 *:netbios-dgm *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:sunrpc *:*
udp 0 0 *:ipp *:*

You can remove the following processes permanently if you don't need the following daemons & services:
  1. Common Unix Printing System Daemon (printing service)
  2. Samba Daemon (enable file and printer sharing for Windows networks)
/home/user> su
Password: {enter root password}

Edit /usr/sbin/services.sh and comment out the lines for "cupsd", "portmap" and "samba". Restart your Eee PC.

For temporary solution until next restart, you can kill the processes.

/home/user> su
Password: {enter root password}
eeepc-m:/home/user>ps -A | grep cupsd
eeepc-m:/home/user>kill {1st column no}
eeepc-m:/home/user>ps -A | grep portmap
eeepc-m:/home/user>kill {1st column no}
eeepc-m:/home/user>ps -A | grep smbd
eeepc-m:/home/user>kill {1st column no}
eeepc-m:/home/user>ps -A | grep nmbd
eeepc-m:/home/user>kill {1st column no}
eeepc-m:/home/user>ps -A | grep dhclient3
eeepc-m:/home/user>kill {1st column no}

You have another option in Full Desktop mode by launching Control Center:
  1. Under System Administration -> Remote Desktop Sharing, uncheck Announce service on the network and click Apply.

No comments: