CSA security

[fisko]

Hello!

I have deployed CSA with policy that allow only VPN tcp and udp traffic with my VPN concentrator on all interfaces, and all ip stack hardening policies against port scans....and DENY ALL TCP UDP....

When I have laptop in my local LAN network i can not use any protocol except make tunnel......

The problem is when I use particular scanner like GFI Lan guard I get over UDP - epmap port 135 computer name and the domain name.

Why CSA can not deny this?

[tsteger1]

The hosts are probably advertising NetBIOS information in several ways and may have registered this information elsewhere.

If you turn off the Server service and disable NetBIOS over TCP on the scanned hosts, that should prevent remote Windows enumeration.

Also, if you have WINS and Computer Browser enabled on the scanning host, it can use that information to resolve IP adresses to names.

Tom

[fisko]

Hello! I know what You mean.

But why should I disable netbios on the scanned host.

Should CSA deny any udp traffic if i had that in policy?

There is no any WINS and I can not browse scanned host.

[tsteger1]

Hi Fisko,

If you want to prevent NetBIOS enumeration, you can either create rules preventing the host from accepting NetBIOS and Location Service connections or try turning off the Server service and disabling NetBIOS over TCP/IP on a host.

The default CSA rules allow hosts to offer these services.

NetBIOS allows the host to advertise and register its name and workgroup/domain with any name service that is listening and storing the information on the local subnet.

NetBIOS over TCP/IP allows it to cross subnets to register with name services.

The location service (port 135) provides endpoint mapping.

The Server service will also advertise to name services.

Tom

[fisko]

If I put the rule

allow TCP/10000, UDP/500, UDP/4500 as client

deny TCP/0-65535 and UDP/0-65535 as client/server

how can CSA allow netbios?

[gojericho0]

Is there another allow network access rule trumping the deny in another Module?

[tsteger1]

NetBIOS is allowed by default via the required system module.

Unless you make a priority deny blocking it or disable the allow rule, it will still be allowed.

Tom

[fisko]

Other think that i find is that CSA protected machine brodcast all netbios info on broadcast ip of the segment even if all upd except udp/4500 is denied?

Why CSA does not stop this traffic?

[tsteger1]

Being CSA protected doesn't stop a host from being a client and that sounds like where the broadcast is coming from.

You can stop this via CSA or Windows settings.

[fisko]

Strange...I add rule deny tcp /udp 135 with priority and after scan there is no open ports....

[tsteger1]

Precisely.

This traffic is allowed by default in the "All applications, server for basic services" rule in the "Required System Module" as I mentioned in an earlier post.

You must either deny it (as you just did) or modify\disable the allow rule.

Tom S