Originally Posted by mbassett

Why on earth would an internet tablet (or a pure desktop machine for that matter) have any open ports or any services listening on such ports?!?!

Originally Posted by darkog

the product is called an 'internet tablet'. so by that name, one assumes one will use this device to connect to other devices and browse the 'internet'. if you are using ssh, nfs, cifs, samba, bluetooth, e.t..c -- you will have ports open. if you don't use them -- turn them off. (check the linux, ubuntu, debian, and other UNIX sites of how you disable services and tweak inetd -- it's pretty straight forward)

if you start disabling services, installing firewall s/f and hardening -- you have to configure them properly (they have no intelligence of their own and they are usually completely unaware of changes done to the network after they are configured - so you have to remember to maintain them) and you should not expect that you device will work flawlessly 100% of the time. you will probably run into connectivity issues and will have to micro-manage it a bit.

but once again, ask yourself, what is your goal? to make sure you don't show up on scans or to have a device that does what you expect it to.

in a previous life, i used to be a network IT guy. the general rule of thumb is -- if you start to lie to the network (proxy, NAT, port blocking, filtering, e.t.c.) the network will start to kick you in the ***.

regarding security on an internet tablet. common sense dictates that you probably dont want to do your online baking and leave important information such as banking, credit card, mortgate on it. it's small and easily stealable. it usues wifi which is easily snoopable and easily trickable.

Originally Posted by brendan

and see what iptables is allowing

Originally Posted by lma

Alternatively you can use netstat on the device, if you trust that it hasn't already been compromised and a rootkit installed ;-)

On mine it currently says:
...
From the above list, the scariest one is 7275, since supllistenerd runs as root and it's a closed source component so can't be audited independently. Note that it's not in the default Diablo installation either though (comes from agps-ui).

Originally Posted by fhofer

How do you find out which process is listening on a port?

Originally Posted by lma

Try lsof -i

Originally Posted by fhofer

thanks for the hint. but I am not sure if the output of lsof -i is complete. this is what I get:

Code:

~/MyDocs/Scripts $ lsof -i
COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAME
browser 1405 user   14u  IPv4   7251       UDP *:60211 
~/MyDocs/Scripts $ netstat -tulne
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:28782         0.0.0.0:*               LISTEN      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      
netstat: no kernel support for AF INET6 (tcp)
udp        0      0 0.0.0.0:2948            0.0.0.0:*                           
udp        0      0 0.0.0.0:60211           0.0.0.0:*                           
udp        0      0 127.0.0.1:53            0.0.0.0:*                           
udp        0      0 127.0.0.1:3001          0.0.0.0:*                           
udp        0      0 127.0.0.1:3002          0.0.0.0:*                           
netstat: no kernel support for AF INET6 (udp)

what about the udp port 2948?