Cfrtjryk

To avoid someone knowing which port are open on my machine, I thought it would useful to open all unused port so that the nmaper is unable to identify which port are really open.

How make a port appear open with an nmap scan

You have got labrea for people scanning your network IP addresses, have not tested it for a good while now.

labrea - Honeypot for incoming IP connection attempts

labrea creates virtual machines for unused IP addresses in the
specified block of IP addresses. LaBrea sits and listens for ARP
"who-has" requests.

When an ARP request for a particular IP goes unanswered for longer
than its "rate" setting (default: 3 seconds), labrea crafts an ARP
reply that routes all traffic destined for the IP to a "bogus" MAC
address. labrea sniffs for TCP/IP traffic sent to that MAC address and
then responds to any SYN packet with a SYN/ACK packet that it creates.

To install it in Debian, do:

sudo apt-get install labrea

As for answering in some designated common ports, and providing alerts, you have got psad, though as far as I remembered it was not about listening all ports.

You can always run honeypots, though I have not tested them for a good while.

Nevertheless, and entering the realm of my opinion, I prefer to drop all connections to unused ports, the less services that are exposed to the outside, the less avenues for attacks.

On Linux, you can use iptables's socket match to have iptables know if a TCP port is in use. Combined with the xtables-addons's TARPIT target (also using LaBrea's concepts) this can make look open any unused TCP port automatically, while leaving actual open ports working as usual. For UDP there's probably not much difference between an open port not answering and a dropped port so I'm not talking about it anymore (just drop udp by default).

Rules:

iptables -N openclosed

iptables -A openclosed -p tcp -m socket --nowildcard -j RETURN

iptables -A openclosed -p tcp -j TARPIT --honeypot

iptables -I INPUT -j openclosed

Caveats: every connection makes a conntrack entry used by netfilter. This solution can thus make a lot of conntrack ressources become used. Bear this in mind when the system is receiving an attack rather than a scan. While TARPIT can be used without netfilter (using NOTRACK), I'm not sure socket can, and anyway this can't be kept as simple as above. Adding the --honeypot option to TARPIT makes it cheaper for the scan if not sending data, but also for netfilter; feel free to remove it. Also --nowildcard might or might not be suitable for router usage (but it's ok anyway for a local usage in the INPUT chain).