Turn off UDP 137?

Question

Turn off UDP 137?

Hi folks,

I need a straightforward command that'll allow me to turn off UDP port 137 on a 10.8.2 machine.

The short story is that a security company is scanning us and is calling this open port a security problem.

I've tried

/sbin/ipfw -f add 65000 deny udp from any to any 137 in

and though ipfw list shows the above deny in the firewall commands, nmap is telling me that udp 137 is still open. Do I need to restart ipfw in order for it to take effect? (if so, what's the command for that?) Is there another command that'll be more effective in turning this dang port off?

Thanks in advance.

Mac mini, OS X Mountain Lion (10.8.2)

Posted on Mar 9, 2013 9:49 PM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Mar 10, 2013 12:56 PM in response to Bill Christensen

Are you being scanned from outside the network or from inside? If the former, you need to close the port on the external interface of your gateway.

Reply

Answer 2

Eric Root

Level 10

685,239 points

Mar 10, 2013 1:24 PM in response to Bill Christensen

Try a restart. It may be necessary for the change to take effect.

Reply

Answer 3

Mar 10, 2013 1:42 PM in response to Bill Christensen

If you do not need netbiosd running, that is, you can live without samba share listed in Finder, you can turn off the service

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.netbiosd.plist

to turn it on again

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.netbiosd.plist

Reply

Answer 4

Mar 11, 2013 12:17 AM in response to Alberto Ravasio

Bingo, this looks like Alberto's suggestion did the trick. I'm almost positive I have no need for netbiosd/Samba (I'll find out soon if there's a problem but I don't anticipate any. Filesharing can be done by FTP.)

In answer to the other questions:

@Linc: Yes, the scanning is being done by an outside service. I was going to say that it seems ridiculous that the port can only be closed by something outside of OSX, but apparently thanks to Alberto's answer I no longer have to say that. ;-)

@Eric: Thanks for the suggestion. Tried that, but the restart wiped the effect of the command.

Thanks much for the feedback.

Reply

Answer 5

Linc Davis

Level 10

209,739 points

Mar 11, 2013 6:13 AM in response to Bill Christensen

Bingo, this looks like Alberto's suggestion did the trick.

Actually, no, it didn't, but enjoy.

Reply

Answer 6

Mar 11, 2013 9:04 AM in response to Linc Davis

Linc Davis wrote:

Bingo, this looks like Alberto's suggestion did the trick.

Actually, no, it didn't, but enjoy.

What makes you say that?

After running Alberto's suggestion and restarting the machine, then

sudo nmap -p 137 -sU -PO <ip address>

from a different machine, I get

137/udp closed netbios-ns

Reply

Answer 7

Linc Davis

Level 10

209,739 points

Mar 11, 2013 9:12 AM in response to Bill Christensen

That has nothing to do with the results of a port scan run from outside your network.

Reply

Answer 8

Mar 11, 2013 11:35 AM in response to Bill Christensen

Linc is right, if your LAN is behind a firewall and the scanning test you mentioned, was done against the public IP assigned to your firewall.

In that case you must operate on the firewall rules to close unwanted open ports.

Reply

Answer 9

Mar 11, 2013 12:33 PM in response to Alberto Ravasio

Just tested from outside the LAN. Still closed.

Thanks again.

Reply

Answer 10

Mar 11, 2013 1:24 PM in response to Bill Christensen

Anyway, to close the thread. Having disabled netbiosd daemon, that does not prevent you to connect to windows shared folders.

You must know the IP address of the target computer and use Finder's Go, Connect to server, and fill in the Server address box with

smb://IP_Target_Computer/Share_Name

and then Connect button. You'll be prompted for authentication.

Reply

Answer 11

jnojr

Level 1

22 points

Sep 12, 2013 2:21 PM in response to Bill Christensen

Just wanted to leave this behind...

You can add ipfw rules and see no change. Why? 'Cause the firewall still isn't actually enabled :-)

sudo sysctl -n net.inet.ip.fw.enable

If that gives a response of "0", the firewall is disabled. You can:

sudo sysctl -w net.inet.ip.fw.enable=1

to enable it. And to make that change persistent across reboots, you can either add that line to the beginning of your firewall script, or touch /etc/sysctl.conf, chmod 640 /etc/sysctl.conf, and append "net.inet.ip.fw.enable=1" to it.

And don't forget about ip6fw... if you use IPv6, lots of people will lock their IPv4 interface down but forget about 6 and leave their system wide open there :-)

Reply