To avoid someone knowing which port are open on my machine, I thought it would useful to open all unused port so that the nmaper is unable to identify which port are really open.
How make a port appear open with an
You have got labrea for people scanning your network IP addresses, have not tested it for a good while now.
labrea - Honeypot for incoming IP connection attempts
labrea creates virtual machines for unused IP addresses in the specified block of IP addresses. LaBrea sits and listens for ARP "who-has" requests.
When an ARP request for a particular IP goes unanswered for longer than its "rate" setting (default: 3 seconds), labrea crafts an ARP reply that routes all traffic destined for the IP to a "bogus" MAC address. labrea sniffs for TCP/IP traffic sent to that MAC address and then responds to any SYN packet with a SYN/ACK packet that it creates.
To install it in Debian, do:
sudo apt-get install labrea
As for answering in some designated common ports, and providing alerts, you have got psad, though as far as I remembered it was not about listening all ports.
You can always run honeypots, though I have not tested them for a good while.
Nevertheless, and entering the realm of my opinion, I prefer to drop all connections to unused ports, the less services that are exposed to the outside, the less avenues for attacks.
On Linux, you can use
socket match to have
iptables know if a
TCP port is in use. Combined with the xtables-addons's
TARPIT target (also using LaBrea's concepts) this can make look open any unused
TCP port automatically, while leaving actual open ports working as usual. For
UDP there's probably not much difference between an open port not answering and a dropped port so I'm not talking about it anymore (just drop udp by default).
iptables -N openclosed iptables -A openclosed -p tcp -m socket --nowildcard -j RETURN iptables -A openclosed -p tcp -j TARPIT --honeypot iptables -I INPUT -j openclosed
Caveats: every connection makes a conntrack entry used by netfilter. This solution can thus make a lot of conntrack ressources become used. Bear this in mind when the system is receiving an attack rather than a scan. While
TARPIT can be used without netfilter (using
NOTRACK), I'm not sure
socket can, and anyway this can't be kept as simple as above. Adding the
--honeypot option to
TARPIT makes it cheaper for the scan if not sending data, but also for netfilter; feel free to remove it. Also
--nowildcard might or might not be suitable for router usage (but it's ok anyway for a local usage in the