Learning Red Hat Linux, Third Edition

Checking Your Security by Using Nmap

Many users have misconfigured firewalls such that they are all but useless in defending against attacks. You can determine the state of your firewall by using the same tool hackers use to find its weaknesses, Nmap. To install Nmap, use the Package Management Tool to install the System Tools package group, and the extra packages nmap and nmap-frontend.

Unfortunately, Nmap doesn’t have a place on the GNOME or KDE menus. You can launch Nmap by issuing the command:

# xnmap &

from a terminal window. The Nmap screen should appear shortly thereafter, as shown in Figure 12-9.

Figure 12-9. Nmap

Nmap has enough features to be the topic of a book. You can learn more about Nmap from its author’s web site, http://www.insecure.org/. A vanilla use of Nmap involves configuring it to send TCP or UDP packets to every important port of a specified system. The target system’s responses reveal whether it has services listening on scanned ports.

To configure Nmap to perform a TCP port scan, specify the IP address of the host, the connect( ) Scan Option, and the TCP & ICMP General Option. Then, commence scanning by clicking Scan. After a few minutes, you’ll see a report like that shown in Figure 12-10. The report shown in the figure indicates that the target host is listening on eight TCP ports. To scan UDP ports, specify the UDP Port Scan Scan Option. UDP port scans ...