| View previous topic :: View next topic |
| Author |
Message |
Lord.DragonFly.of.Dawn
Advanced Member
Joined: 18 Jul 2024
Posts: 607
Location: South Portland, Maine, USA, Earth, Sol System
|
 Posted: Thu Mar 12, 2024 9:46 pm Post subject: Open ports across the network. [tentatively resolved] |
 |
|
I'm running into an interesting problem.
I have a server setup with some daemons and nothing else. I set this up yesterday and have yet to move outside my private subnet.
Here is why.
when I nmap my ports from the machine it presents the list i would expect, but if i do it form any other machine on the net it presents a MUCH different view.
From Naru (the affected machine)
| Code: | Naru$ nmap 192.168.42.2
Starting Nmap 4.62 ( http://nmap.org ) at 2024-03-12 17:39 EDT
Interesting ports on Naru (192.168.42.2):
Not shown: 1705 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
2049/tcp open nfs
Nmap done: 1 IP address (1 host up) scanned in 0.254 seconds |
from Mizuho (one of my other linux machines)
| Code: | nmap 192.168.42.2
Starting Nmap 4.62 ( http://nmap.org ) at 2024-03-12 17:42 EDT
Interesting ports on 192.168.42.2:
Not shown: 1699 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
67/tcp filtered dhcps
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
135/tcp filtered msrpc
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
143/tcp open imap
445/tcp filtered microsoft-ds
593/tcp filtered http-rpc-epmap
2049/tcp open nfs
Nmap done: 1 IP address (1 host up) scanned in 5.474 seconds |
This is actually one of the smaller listings i've seen. I've had port listings from this machine with upwards of 2024 ports open.
Needless to say until I lick this problem I won't be bringing it out of quarantine. Does anyone have any ideas what I could to to figure this out?
I suppose I could just setup iptables to block all those unwanted ports, but i'd feel more comfortable knowing the underlying reason.
_________________
ArchLinux x86_64 - Custom Built Desktop
ArchLinux x86_64 - Compaq CQ50 Laptop
ArchLinux i686 - Acer Aspire One Netbook
ArchLinux i686 - Dell Presario ze2000 (w/ shattered LCD)
PuppyLinux, CloneZilla, PartedMagic, DBAN - rescue thumbdrives
Windows 7 (x86_64 desktop alternate boot)
Last edited by Lord.DragonFly.of.Dawn on Wed Mar 18, 2024 2:59 am; edited 1 time in total |
|
| Back to top |
|
crouse
Site Admin
Joined: 17 Apr 2024
Posts: 11833
Location: Iowa
|
| Posted: Fri Mar 13, 2024 6:11 am Post subject: |
|
|
Scanned Archie -- ssh port hasn't been changed yet... gives me exactly what I thought it should.
| Code: |
[HOME SERVER-root@localhost ~]# nmap 192.168.2.8
Starting Nmap 4.76 ( http://nmap.org ) at 2024-03-13 01:05 CDT
Interesting ports on 192.168.2.8:
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: XXXXXXXXXXXXX (IBM)
Nmap done: 1 IP address (1 host up) scanned in 0.54 seconds
[HOME SERVER-root@localhost ~]#
|
I guess I'd want to know what distro your running. It almost looks like something is starting your services... unless they are just set to start at boot.
_________________
Veronica - Arch Linux 64-bit -- Kernel 2.6.33.4-1
Archie/Jughead - Arch Linux 32-bit -- Kernel 2.6.33.4-1
Betty/Reggie - Arch Linux (VBox) 32-bit -- Kernel 2.6.33.4-1
BumbleBee - OpenSolaris-SunOS 5.11
|
|
| Back to top |
|
hakova
New Member
Joined: 03 Feb 2024
Posts: 40
Location: Virginia
|
| Posted: Sat Mar 14, 2024 5:50 pm Post subject: |
|
|
I don't mean to hijack the thread but here is what I have:
| Code: | [hako@shebiaruz ~]$ nmap shebiaruz
Starting Nmap 4.76 ( http://nmap.org ) at 2024-03-14 13:18 EDT
Interesting ports on shebiaruz (127.0.0.1):
Not shown: 993 closed ports
PORT STATE SERVICE
25/tcp open smtp
111/tcp open rpcbind
443/tcp open https
587/tcp open submission
631/tcp open ipp
3000/tcp open ppp
6000/tcp open X11
Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds |
I am using Mandriva 2024.0. The port that is intentionally opened include 443 only. The rest of the ports listed by nmap do *not* match with shorewall settings either. Shorewall lists other ports being open for cups, bittorrent, etc. but not the ones listed by nmap. Curiously nmap does not report those as open.
For ports 25,111 and perhaps 631, 3000 (I don't even have a modem), 6000, I suspect picasa (google's picture sharing / uploading program) might be responsible. During the installation of picasa, sendmail had to be installed as a prerequisite, that is what makes me think this way, but I am not sure of course. Is there a way to find out what opens these ports?
Among those that are reported open by nmap, port 587 (submission) scares me most by its name.
|
|
| Back to top |
|
masinick
Linux Guru
Joined: 03 Apr 2024
Posts: 8615
Location: Concord, NH
|
| Posted: Sat Mar 14, 2024 6:30 pm Post subject: |
|
|
| Port 587 is sometimes implemented as the replacement SMTP port; the old SMTP port used to be 25 if I remember right, and 110 was the POP port. I have seen port 631 used by webmin in the past, so that port might be used by a printer administration tool, possibly CUPS. Try shutting down a few of those ports and see if any functionality that you need stops. If you don't miss the ports open, leave them off. At least you will then find out if they are actively being used. You can turn them on when you need them and shut them off when you don't need them; nothing prevents you from doing that, other than your own time and your level of concern. |
|
| Back to top |
|
hakova
New Member
Joined: 03 Feb 2024
Posts: 40
Location: Virginia
|
| Posted: Sat Mar 14, 2024 6:59 pm Post subject: |
|
|
| masinick wrote: | | (...) I have seen port 631 used by webmin in the past, so that port might be used by a printer administration tool, possibly CUPS. |
You are right, I just failed to see that. I need it for cups.
| Quote: | | Try shutting down a few of those ports and see if any functionality that you need stops. |
When you say shutting down the port, do you mean blocking the port by the firewall? If not, I am not sure how to do it. If that was what you meant, I believe they should already be considered closed because shorewall settings do not indicate that these ports (25,111,587,3000,6000) are actually open.
[paranoid]Is it possible that shorewall is being tricked to not block these ports despite its configuration set to block them?[/paranoid]
|
|
| Back to top |
|
masinick
Linux Guru
Joined: 03 Apr 2024
Posts: 8615
Location: Concord, NH
|
| Posted: Sat Mar 14, 2024 9:08 pm Post subject: |
|
|
| I do not see all that many ports open, and the ports listed are commonly used for real network activity. If your paranoia is that high, turn on a packet sniffer and watch everything that comes by. I do not think that you are being seriously compromised. In the past, when I have monitored network activity, I find software that is trying to access my system all the time - and not getting very far at all. Such processes usually give up when they realize that they are not getting anywhere. |
|
| Back to top |
|
hakova
New Member
Joined: 03 Feb 2024
Posts: 40
Location: Virginia
|
| Posted: Sun Mar 15, 2024 12:10 am Post subject: |
|
|
| Thanks for the expert opinion masinick. I actually don't have a high paranoia, whatever amount I have stems from my ignorance. Your insight was enough to calm it down.
|
|
| Back to top |
|
Lord.DragonFly.of.Dawn
Advanced Member
Joined: 18 Jul 2024
Posts: 607
Location: South Portland, Maine, USA, Earth, Sol System
|
| Posted: Sun Mar 15, 2024 3:01 am Post subject: |
|
|
I've identified the open ports in the listings i posted previously and they are all valid for the servers I have set up. I have configured iptables to block all other ports and have lost no functionality.
however I still periodically get the odd nmap readings. I'll get a huge jump in open ports (despite having iptables configured) that stay open for between 5 minutes and an hour before closing again. running a packet sniffer during this shows no activity on any of the questionable ports aside from the occasional icmp ping that is is not acknowledged (due to iptables probably). Below is a copy of the output from one of those scans.
I am running a vanilla install of debian lenny with no 3rd party debs/apps installed. It was installed via the official ISO (the same one that i used to install my laptop which does *NOT* show the same issue)
I'm not planning to use the box for any sensitive data, but I am worried that this issue might manifest on other machines on my network which will carry data that is sensitive. I'm not normally a paranoid man but I do worry when network ports are open for no apparent reason (a throwback to my windows days)
Thank your for your time and assistance.
-Pat
| Code: |
Starting Nmap 4.62 ( http://nmap.org ) at 2024-03-14 22:50 EDT
Interesting ports on 192.168.42.2:
Not shown: 643 closed ports
PORT STATE SERVICE
1/tcp open tcpmux
2/tcp open compressnet
3/tcp open compressnet
4/tcp open unknown
5/tcp open rje
7/tcp open echo
8/tcp open unknown
10/tcp open unknown
12/tcp open unknown
15/tcp open netstat
16/tcp open unknown
18/tcp open msp
20/tcp open ftp-data
21/tcp open ftp
22/tcp open ssh
24/tcp open priv-mail
25/tcp open smtp
28/tcp open unknown
29/tcp open msg-icp
30/tcp open unknown
32/tcp open unknown
36/tcp open unknown
39/tcp open rlp
41/tcp open graphics
42/tcp open nameserver
43/tcp open whois
44/tcp open mpm-flags
45/tcp open mpm
46/tcp open mpm-snd
48/tcp open auditd
51/tcp open la-maint
52/tcp open xns-time
54/tcp open xns-ch
55/tcp open isi-gl
56/tcp open xns-auth
57/tcp open priv-term
59/tcp open priv-file
61/tcp open ni-mail
62/tcp open acas
63/tcp open via-ftp
64/tcp open covia
65/tcp open tacacs-ds
68/tcp open dhcpc
69/tcp open tftp
70/tcp open gopher
71/tcp open netrjs-1
72/tcp open netrjs-2
74/tcp open netrjs-4
75/tcp open priv-dial
76/tcp open deos
78/tcp open vettcp
79/tcp open finger
80/tcp open http
82/tcp open xfer
83/tcp open mit-ml-dev
85/tcp open mit-ml-dev
86/tcp open mfcobol
87/tcp open priv-term-l
88/tcp open kerberos-sec
89/tcp open su-mit-tg
92/tcp open npp
93/tcp open dcp
94/tcp open objcall
95/tcp open supdup
96/tcp open dixie
97/tcp open swift-rvf
100/tcp open newacct
101/tcp open hostname
102/tcp open iso-tsap
103/tcp open gppitnp
106/tcp open pop3pw
108/tcp open snagas
109/tcp open pop2
110/tcp open pop3
111/tcp open rpcbind
112/tcp open mcidas
114/tcp open audionews
116/tcp open ansanotify
118/tcp open sqlserv
120/tcp open cfdptkt
122/tcp open smakynet
124/tcp open ansatrader
128/tcp open gss-xlicen
130/tcp open cisco-fna
131/tcp open cisco-tna
132/tcp open cisco-sys
133/tcp open statsrv
134/tcp open ingres-net
135/tcp open msrpc
138/tcp open netbios-dgm
139/tcp open netbios-ssn
140/tcp open emfis-data
142/tcp open bl-idm
143/tcp open imap
144/tcp open news
146/tcp open iso-tp0
147/tcp open iso-ip
149/tcp open aed-512
150/tcp open sql-net
153/tcp open sgmp
154/tcp open netsc-prod
155/tcp open netsc-dev
156/tcp open sqlsrv
158/tcp open pcmail-srv
159/tcp open nss-routing
160/tcp open sgmp-traps
162/tcp open snmptrap
163/tcp open cmip-man
164/tcp open cmip-agent
165/tcp open xns-courier
168/tcp open rsvd
171/tcp open multiplex
172/tcp open cl-1
178/tcp open nextstep
180/tcp open ris
182/tcp open audit
183/tcp open ocbinder
185/tcp open remote-kis
186/tcp open kis
188/tcp open mumps
189/tcp open qft
190/tcp open gacp
191/tcp open prospero
192/tcp open osu-nms
193/tcp open srmp
196/tcp open dn6-smm-red
197/tcp open dls
198/tcp open dls-mon
199/tcp open smux
200/tcp open src
201/tcp open at-rtmp
202/tcp open at-nbp
203/tcp open at-3
204/tcp open at-echo
208/tcp open at-8
209/tcp open tam
211/tcp open 914c-g
212/tcp open anet
213/tcp open ipx
216/tcp open atls
217/tcp open dbase
220/tcp open imap3
222/tcp open rsh-spx
223/tcp open cdc
224/tcp open unknown
225/tcp open unknown
226/tcp open unknown
228/tcp open unknown
229/tcp open unknown
230/tcp open unknown
232/tcp open unknown
233/tcp open unknown
234/tcp open unknown
235/tcp open unknown
236/tcp open unknown
237/tcp open unknown
238/tcp open unknown
241/tcp open unknown
242/tcp open direct
243/tcp open sur-meas
244/tcp open dayna
245/tcp open link
246/tcp open dsp3270
247/tcp open subntbcst_tftp
248/tcp open bhfhs
250/tcp open unknown
252/tcp open unknown
257/tcp open fw1-mc-fwmodule
258/tcp open fw1-mc-gui
259/tcp open esro-gen
260/tcp open openport
261/tcp open nsiiops
263/tcp open hdap
266/tcp open unknown
268/tcp open unknown
269/tcp open unknown
271/tcp open unknown
274/tcp open unknown
275/tcp open unknown
278/tcp open unknown
280/tcp open http-mgmt
281/tcp open personal-link
283/tcp open unknown
285/tcp open unknown
288/tcp open unknown
290/tcp open unknown
292/tcp open unknown
293/tcp open unknown
294/tcp open unknown
295/tcp open unknown
296/tcp open unknown
297/tcp open unknown
298/tcp open unknown
303/tcp open unknown
304/tcp open unknown
305/tcp open unknown
308/tcp open novastorbakcup
310/tcp open bhmds
311/tcp open asip-webadmin
312/tcp open vslmp
313/tcp open magenta-logic
315/tcp open dpsi
316/tcp open decauth
317/tcp open zannet
319/tcp open unknown
320/tcp open unknown
321/tcp open pip
322/tcp open unknown
323/tcp open unknown
324/tcp open unknown
325/tcp open unknown
328/tcp open unknown
330/tcp open unknown
331/tcp open unknown
335/tcp open unknown
336/tcp open unknown
339/tcp open unknown
340/tcp open unknown
341/tcp open unknown
342/tcp open unknown
344/tcp open pdap
345/tcp open pawserv
346/tcp open zserv
347/tcp open fatserv
348/tcp open csi-sgwp
349/tcp open mftp
350/tcp open matip-type-a
352/tcp open dtag-ste-sb
353/tcp open ndsauth
354/tcp open bh611
355/tcp open datex-asn
356/tcp open cloanto-net-1
365/tcp open dtk
367/tcp open mortgageware
369/tcp open rpc2portmap
370/tcp open codaauth2
371/tcp open clearcase
372/tcp open ulistserv
373/tcp open legent-1
374/tcp open legent-2
376/tcp open nip
378/tcp open dsETOS
379/tcp open is99c
380/tcp open is99s
381/tcp open hp-collector
382/tcp open hp-managed-node
383/tcp open hp-alarm-mgr
384/tcp open arns
385/tcp open ibm-app
390/tcp open uis
393/tcp open dis
396/tcp open netware-ip
397/tcp open mptn
400/tcp open work-sol
405/tcp open ncld
407/tcp open timbuktu
410/tcp open decladebug
413/tcp open smsp
415/tcp open bnet
416/tcp open silverplatter
417/tcp open onmux
418/tcp open hyper-g
420/tcp open smpte
421/tcp open ariel2
422/tcp open ariel3
424/tcp open opc-job-track
425/tcp open icad-el
426/tcp open smartsdp
427/tcp open svrloc
429/tcp open ocs_amu
430/tcp open utmpsd
432/tcp open iasd
435/tcp open mobilip-mn
436/tcp open dna-cml
438/tcp open dsfgw
444/tcp open snpp
445/tcp open microsoft-ds
446/tcp open ddm-rdb
447/tcp open ddm-dfm
448/tcp open ddm-ssl
450/tcp open tserver
451/tcp open sfs-smp-net
452/tcp open sfs-config
453/tcp open creativeserver
454/tcp open contentserver
457/tcp open scohelp
460/tcp open skronk
461/tcp open datasurfsrv
465/tcp open smtps
469/tcp open rcp
471/tcp open mondex
476/tcp open tn-tl-fd1
477/tcp open ss7ns
478/tcp open spsc
479/tcp open iafserver
480/tcp open loadsrv
481/tcp open dvs
483/tcp open ulpnet
484/tcp open integra-sme
485/tcp open powerburst
486/tcp open sstats
488/tcp open gss-http
489/tcp open nest-protocol
490/tcp open micom-pfs
491/tcp open go-login
492/tcp open ticf-1
493/tcp open ticf-2
494/tcp open pov-ray
495/tcp open intecourier
496/tcp open pim-rp-disc
497/tcp open retrospect
500/tcp open isakmp
501/tcp open stmf
502/tcp open asa-appl-proto
503/tcp open intrinsa
504/tcp open citadel
505/tcp open mailbox-lm
507/tcp open crs
508/tcp open xvttp
509/tcp open snare
511/tcp open passgo
513/tcp open login
514/tcp open shell
515/tcp open printer
517/tcp open talk
521/tcp open ripng
523/tcp open ibm-db2
524/tcp open ncp
525/tcp open timed
527/tcp open stx
528/tcp open custix
530/tcp open courier
531/tcp open conference
533/tcp open netwall
536/tcp open opalis-rdv
539/tcp open apertus-ldp
540/tcp open uucp
543/tcp open klogin
544/tcp open kshell
546/tcp open dhcpv6-client
549/tcp open idfp
550/tcp open new-rwho
551/tcp open cybercash
552/tcp open deviceshare
555/tcp open dsf
556/tcp open remotefs
557/tcp open openvms-sysipc
558/tcp open sdnskmp
560/tcp open rmonitor
561/tcp open monitor
564/tcp open 9pfs
565/tcp open whoami
566/tcp open streettalk
568/tcp open ms-shuttle
569/tcp open ms-rome
570/tcp open meter
571/tcp open umeter
573/tcp open banyan-vip
574/tcp open ftp-agent
575/tcp open vemmi
576/tcp open ipcd
579/tcp open decbsrv
580/tcp open sntp-heartbeat
582/tcp open scc-security
585/tcp open imap4-ssl
587/tcp open submission
589/tcp open eyelink
590/tcp open tns-cml
591/tcp open http-alt
592/tcp open eudora-set
593/tcp open http-rpc-epmap
595/tcp open cab-protocol
596/tcp open smsd
598/tcp open sco-websrvrmg3
599/tcp open acp
601/tcp open unknown
603/tcp open mnotes
605/tcp open unknown
606/tcp open urm
608/tcp open sift-uft
609/tcp open npmp-trap
610/tcp open npmp-local
611/tcp open npmp-gui
612/tcp open unknown
614/tcp open unknown
615/tcp open unknown
619/tcp open unknown
622/tcp open unknown
623/tcp open unknown
624/tcp open unknown
625/tcp open apple-xsrvr-admin
626/tcp open apple-imap-admin
627/tcp open unknown
628/tcp open qmqp
629/tcp open unknown
630/tcp open unknown
631/tcp open ipp
633/tcp open unknown
634/tcp open ginad
637/tcp open lanserver
638/tcp open unknown
644/tcp open unknown
645/tcp open unknown
647/tcp open unknown
648/tcp open unknown
650/tcp open unknown
651/tcp open unknown
652/tcp open unknown
654/tcp open unknown
655/tcp open unknown
660/tcp open mac-srvr-admin
661/tcp open unknown
662/tcp open unknown
664/tcp open unknown
667/tcp open unknown
668/tcp open unknown
669/tcp open unknown
670/tcp open unknown
672/tcp open unknown
673/tcp open unknown
675/tcp open unknown
676/tcp open unknown
677/tcp open unknown
680/tcp open unknown
683/tcp open unknown
684/tcp open unknown
685/tcp open unknown
687/tcp open unknown
688/tcp open unknown
689/tcp open unknown
690/tcp open unknown
692/tcp open unknown
693/tcp open unknown
694/tcp open unknown
695/tcp open unknown
698/tcp open unknown
699/tcp open unknown
702/tcp open unknown
703/tcp open unknown
704/tcp open elcsd
705/tcp open unknown
706/tcp open silc
707/tcp open unknown
708/tcp open unknown
709/tcp open entrustmanager
711/tcp open unknown
712/tcp open unknown
713/tcp open unknown
714/tcp open unknown
715/tcp open unknown
716/tcp open unknown
717/tcp open unknown
720/tcp open unknown
721/tcp open unknown
722/tcp open unknown
724/tcp open unknown
727/tcp open unknown
728/tcp open unknown
729/tcp open netviewdm1
730/tcp open netviewdm2
735/tcp open unknown
736/tcp open unknown
739/tcp open unknown
740/tcp open netcp
741/tcp open netgw
742/tcp open netrcs
744/tcp open flexlm
746/tcp open unknown
747/tcp open fujitsu-dev
748/tcp open ris-cm
749/tcp open kerberos-adm
750/tcp open kerberos
753/tcp open rrh
756/tcp open unknown
757/tcp open unknown
758/tcp open nlogin
760/tcp open krbupdate
761/tcp open kpasswd
762/tcp open quotad
763/tcp open cycleserv
764/tcp open omserv
765/tcp open webster
767/tcp open phonebook
770/tcp open cadlock
772/tcp open cycleserv2
774/tcp open rpasswd
777/tcp open unknown
778/tcp open unknown
779/tcp open unknown
780/tcp open wpgs
786/tcp open concert
787/tcp open unknown
788/tcp open unknown
789/tcp open unknown
790/tcp open unknown
791/tcp open unknown
792/tcp open unknown
793/tcp open unknown
794/tcp open unknown
795/tcp open unknown
796/tcp open unknown
797/tcp open unknown
798/tcp open unknown
799/tcp open controlit
800/tcp open mdbs_daemon
801/tcp open device
802/tcp open unknown
805/tcp open unknown
806/tcp open unknown
807/tcp open unknown
808/tcp open ccproxy-http
811/tcp open unknown
812/tcp open unknown
813/tcp open unknown
815/tcp open unknown
817/tcp open unknown
818/tcp open unknown
820/tcp open unknown
821/tcp open unknown
822/tcp open unknown
823/tcp open unknown
825/tcp open unknown
826/tcp open unknown
828/tcp open unknown
829/tcp open unknown
830/tcp open unknown
831/tcp open unknown
832/tcp open unknown
833/tcp open unknown
835/tcp open unknown
836/tcp open unknown
838/tcp open unknown
840/tcp open unknown
841/tcp open unknown
844/tcp open unknown
845/tcp open unknown
847/tcp open unknown
848/tcp open unknown
849/tcp open unknown
853/tcp open unknown
854/tcp open unknown
855/tcp open unknown
856/tcp open unknown
857/tcp open unknown
858/tcp open unknown
859/tcp open unknown
863/tcp open unknown
865/tcp open unknown
866/tcp open unknown
870/tcp open unknown
871/tcp open supfilesrv
872/tcp open unknown
873/tcp open rsync
874/tcp open unknown
878/tcp open unknown
879/tcp open unknown
880/tcp open unknown
886/tcp open unknown
889/tcp open unknown
890/tcp open unknown
891/tcp open unknown
893/tcp open unknown
894/tcp open unknown
896/tcp open unknown
897/tcp open unknown
900/tcp open unknown
901/tcp open samba-swat
902/tcp open iss-realsecure
903/tcp open iss-console-mgr
905/tcp open unknown
908/tcp open unknown
912/tcp open unknown
916/tcp open unknown
918/tcp open unknown
920/tcp open unknown
921/tcp open unknown
923/tcp open unknown
926/tcp open unknown
928/tcp open unknown
930/tcp open unknown
931/tcp open unknown
933/tcp open unknown
934/tcp open unknown
937/tcp open unknown
940/tcp open unknown
943/tcp open unknown
945/tcp open unknown
946/tcp open unknown
947/tcp open unknown
950/tcp open oftep-rpc
951/tcp open unknown
953/tcp open rndc
955/tcp open unknown
958/tcp open unknown
959/tcp open unknown
960/tcp open unknown
962/tcp open unknown
963/tcp open unknown
964/tcp open unknown
965/tcp open unknown
967/tcp open unknown
969/tcp open unknown
972/tcp open unknown
973/tcp open unknown
975/tcp open securenetpro-sensor
977/tcp open unknown
978/tcp open unknown
979/tcp open unknown
981/tcp open unknown
982/tcp open unknown
983/tcp open unknown
984/tcp open unknown
985/tcp open unknown
987/tcp open unknown
989/tcp open ftps-data
994/tcp open ircs
996/tcp open xtreelic
997/tcp open maitrd
999/tcp open garcon
1000/tcp open cadlock
1001/tcp open unknown
1003/tcp open unknown
1007/tcp open unknown
1008/tcp open ufsd
1010/tcp open unknown
1011/tcp open unknown
1012/tcp open unknown
1013/tcp open unknown
1015/tcp open unknown
1017/tcp open unknown
1018/tcp open unknown
1019/tcp open unknown
1021/tcp open unknown
1022/tcp open unknown
1026/tcp open LSA-or-nterm
1029/tcp open ms-lsa
1030/tcp open iad1
1031/tcp open iad2
1032/tcp open iad3
1040/tcp open netsaint
1058/tcp open nim
1067/tcp open instl_boots
1068/tcp open instl_bootc
1076/tcp open sns_credit
1080/tcp open socks
1083/tcp open ansoft-lm-1
1084/tcp open ansoft-lm-2
1103/tcp open xaudio
1109/tcp open kpop
1110/tcp open nfsd-status
1112/tcp open msql
1139/tcp open cce3x
1155/tcp open nfa
1158/tcp open lsnr
1178/tcp open skkserv
1212/tcp open lupa
1220/tcp open quicktime
1248/tcp open hermes
1337/tcp open waste
1347/tcp open bbn-mmc
1351/tcp open equationbuilder
1352/tcp open lotusnotes
1353/tcp open relief
1354/tcp open rightbrain
1355/tcp open intuitive-edge
1356/tcp open cuillamartin
1358/tcp open connlcli
1359/tcp open ftsrv
1360/tcp open mimer
1364/tcp open ndm-server
1373/tcp open chromagrafx
1377/tcp open cichlid
1378/tcp open elan
1380/tcp open telesis-licman
1384/tcp open os-licman
1385/tcp open atex_elmd
1387/tcp open cadsi-lm
1388/tcp open objective-dbc
1389/tcp open iclpv-dm
1390/tcp open iclpv-sc
1391/tcp open iclpv-sas
1392/tcp open iclpv-pm
1393/tcp open iclpv-nls
1395/tcp open iclpv-wsm
1396/tcp open dvl-activemail
1397/tcp open audio-activmail
1400/tcp open cadkey-tablet
1401/tcp open goldleaf-licman
1403/tcp open prm-nm-np
1404/tcp open igi-lm
1406/tcp open netlabs-lm
1409/tcp open here-lm
1410/tcp open hiq
1411/tcp open af
1412/tcp open innosys
1413/tcp open innosys-acl
1414/tcp open ibm-mqseries
1416/tcp open novell-lu6.2
1417/tcp open timbuktu-srv1
1418/tcp open timbuktu-srv2
1419/tcp open timbuktu-srv3
1421/tcp open gandalf-lm
1422/tcp open autodesk-lm
1424/tcp open hybrid
1425/tcp open zion-lm
1427/tcp open mloadd
1428/tcp open informatik-lm
1429/tcp open nms
1431/tcp open rgtp
1432/tcp open blueberry-lm
1434/tcp open ms-sql-m
1435/tcp open ibm-cics
1437/tcp open tabula
1439/tcp open eicon-x25
1440/tcp open eicon-slp
1442/tcp open cadis-2
1443/tcp open ies-lm
1444/tcp open marcam-lm
1445/tcp open proxima-lm
1446/tcp open ora-lm
1448/tcp open oc-lm
1449/tcp open peport
1450/tcp open dwf
1452/tcp open gtegsc-lm
1454/tcp open interhdl_elmd
1456/tcp open dca
1457/tcp open valisys-lm
1458/tcp open nrcabq-lm
1461/tcp open ibm_wrless_lan
1462/tcp open world-lm
1463/tcp open nucleus
1464/tcp open msl_lmd
1465/tcp open pipes
1466/tcp open oceansoft-lm
1467/tcp open csdmbase
1469/tcp open aal-lm
1471/tcp open csdmbase
1472/tcp open csdm
1473/tcp open openmath
1478/tcp open ms-sna-base
1480/tcp open pacerforum
1481/tcp open airs
1482/tcp open miteksys-lm
1485/tcp open lansource
1488/tcp open docstor
1493/tcp open netmap_lm
1494/tcp open citrix-ica
1497/tcp open rfx-lm
1498/tcp open watcom-sql
1499/tcp open fhc
1501/tcp open sas-3
1502/tcp open shivadiscovery
1504/tcp open evb-elm
1507/tcp open symplex
1508/tcp open diagmond
1510/tcp open mvx-lm
1511/tcp open 3l-l1
1512/tcp open wins
1514/tcp open fujitsu-dtcns
1515/tcp open ifor-protocol
1516/tcp open vpad
1518/tcp open vpvd
1521/tcp open oracle
1522/tcp open rna-lm
1524/tcp open ingreslock
1527/tcp open tlisrv
1528/tcp open mciautoreg
1531/tcp open rap-listen
1532/tcp open miroconnect
1533/tcp open virtual-places
1534/tcp open micromuse-lm
1538/tcp open 3ds-lm
1540/tcp open rds
1541/tcp open rds2
1544/tcp open aspeclmd
1545/tcp open vistium-share
1547/tcp open laplink
1548/tcp open axon-lm
1549/tcp open shivahose
1550/tcp open 3m-image-lm
1551/tcp open hecmtl-db
1600/tcp open issd
1650/tcp open nkd
1652/tcp open xnmp
1663/tcp open netview-aix-3
1664/tcp open netview-aix-4
1665/tcp open netview-aix-5
1667/tcp open netview-aix-7
1668/tcp open netview-aix-8
1669/tcp open netview-aix-9
1670/tcp open netview-aix-10
1671/tcp open netview-aix-11
1720/tcp open H.323/Q.931
1761/tcp open landesk-rc
1762/tcp open landesk-rc
1763/tcp open landesk-rc
1827/tcp open pcm
1900/tcp open upnp
1984/tcp open bigbrother
1986/tcp open licensedaemon
1987/tcp open tr-rsrb-p1
1988/tcp open tr-rsrb-p2
1989/tcp open tr-rsrb-p3
1990/tcp open stun-p1
1992/tcp open stun-p3
1993/tcp open snmp-tcp-port
1995/tcp open perf-port
1996/tcp open tr-rsrb-port
1997/tcp open gdp-port
1998/tcp open x25-svc-port
1999/tcp open tcp-id-port
2000/tcp open callbook
2002/tcp open globe
2005/tcp open deslogin
2006/tcp open invokator
2007/tcp open dectalk
2009/tcp open news
2010/tcp open search
2011/tcp open raid-cc
2012/tcp open ttyinfo
2013/tcp open raid-am
2014/tcp open troff
2015/tcp open cypress
2016/tcp open bootserver
2017/tcp open cypress-stat
2018/tcp open terminaldb
2019/tcp open whosockami
2020/tcp open xinupageserver
2021/tcp open servexec
2023/tcp open xinuexpansion3
2024/tcp open xinuexpansion4
2025/tcp open ellpack
2027/tcp open shadowserver
2028/tcp open submitserver
2030/tcp open device2
2032/tcp open blackboard
2033/tcp open glogger
2035/tcp open imsldoc
2042/tcp open isis
2044/tcp open rimsl
2045/tcp open cdfunc
2046/tcp open sdfunc
2049/tcp open nfs
2053/tcp open knetd
2065/tcp open dlsrpn
2067/tcp open dlswpn
2068/tcp open advocentkvm
2106/tcp open ekshell
2112/tcp open kip
2121/tcp open ccproxy-ftp
2201/tcp open ats
2232/tcp open ivs-video
2301/tcp open compaqdiag
2307/tcp open pehelp
2433/tcp open codasrv-se
2500/tcp open rtsserv
2501/tcp open rtsclient
2564/tcp open hp-3000-telnet
2601/tcp open zebra
2602/tcp open ripd
2603/tcp open ripngd
2604/tcp open ospfd
2627/tcp open webster
2628/tcp open dict
2766/tcp open listen
2903/tcp open extensisportfolio
2998/tcp open iss-realsec
3001/tcp open nessus
3006/tcp open deslogind
3025/tcp open slnp
3049/tcp open cfs
3064/tcp open dnet-tstproxy
3128/tcp open squid-http
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3292/tcp open meetingmaker
3306/tcp open mysql
3333/tcp open dec-notes
3372/tcp open msdtc
3397/tcp open saposs
3398/tcp open sapcomm
3399/tcp open sapeps
3462/tcp open track
3531/tcp open peerenabler
3984/tcp open mapper-nodemgr
3985/tcp open mapper-mapethd
3986/tcp open mapper-ws_ethd
3999/tcp open remoteanything
4000/tcp open remoteanything
4002/tcp open mlchat-proxy
4008/tcp open netcheque
4133/tcp open nuts_bootp
4144/tcp open wincim
4199/tcp open eims-admin
4321/tcp open rwhois
4333/tcp open msql
4343/tcp open unicall
4444/tcp open krb524
4480/tcp open proxy-plus
4557/tcp open fax
4559/tcp open hylafax
4660/tcp open mosmig
4672/tcp open rfa
4899/tcp open radmin
4987/tcp open maybe-veritas
4998/tcp open maybe-veritas
5000/tcp open upnp
5001/tcp open commplex-link
5002/tcp open rfe
5011/tcp open telelpathattack
5100/tcp open admd
5101/tcp open admdog
5102/tcp open admeng
5145/tcp open rmonitor_secure
5190/tcp open aol
5191/tcp open aol-1
5192/tcp open aol-2
5193/tcp open aol-3
5236/tcp open padl2sim
5300/tcp open hacl-hb
5302/tcp open hacl-cfg
5305/tcp open hacl-test
5400/tcp open pcduo-old
5405/tcp open pcduo
5432/tcp open postgresql
5490/tcp open connect-proxy
5500/tcp open hotline
5510/tcp open secureidprop
5520/tcp open sdlog
5530/tcp open sdserv
5540/tcp open sdreport
5555/tcp open freeciv
5631/tcp open pcanywheredata
5632/tcp open pcanywherestat
5679/tcp open activesync
5680/tcp open canna
5714/tcp open prosharevideo
5715/tcp open prosharedata
5716/tcp open prosharerequest
5717/tcp open prosharenotify
5801/tcp open vnc-http-1
5802/tcp open vnc-http-2
5803/tcp open vnc-http-3
5900/tcp open vnc
5901/tcp open vnc-1
5977/tcp open ncd-pref-tcp
5978/tcp open ncd-diag-tcp
5979/tcp open ncd-conf-tcp
5997/tcp open ncd-pref
5999/tcp open ncd-conf
6000/tcp open X11
6002/tcp open X11:2
6003/tcp open X11:3
6004/tcp open X11:4
6005/tcp open X11:5
6006/tcp open X11:6
6007/tcp open X11:7
6009/tcp open X11:9
6017/tcp open xmail-ctrl
6050/tcp open arcserve
6101/tcp open backupexec
6103/tcp open RETS-or-BackupExec
6105/tcp open isdninfo
6106/tcp open isdninfo
6110/tcp open softcm
6112/tcp open dtspc
6142/tcp open aspentec-lm
6147/tcp open montage-lm
6346/tcp open gnutella
6502/tcp open netop-rc
6544/tcp open mythtv
6547/tcp open powerchuteplus
6548/tcp open powerchuteplus
6588/tcp open analogx
6662/tcp open radmind
6665/tcp open irc
6666/tcp open irc
6667/tcp open irc
6668/tcp open irc
6669/tcp open irc
6670/tcp open irc
6699/tcp open napster
6700/tcp open carracho
6701/tcp open carracho
7002/tcp open afs3-prserver
7003/tcp open afs3-vlserver
7004/tcp open afs3-kaserver
7005/tcp open afs3-volser
7006/tcp open afs3-errors
7007/tcp open afs3-bos
7008/tcp open afs3-update
7009/tcp open afs3-rmtsys
7010/tcp open ups-onlinet
7100/tcp open font-service
7200/tcp open fodms
7273/tcp open openmanage
7464/tcp open pythonds
7597/tcp open qaz
7938/tcp open lgtomapper
8000/tcp open http-alt
8007/tcp open ajp12
8009/tcp open ajp13
8076/tcp open slnp
8081/tcp open blackice-icecap
8082/tcp open blackice-alerts
8770/tcp open apple-iphoto
8888/tcp open sun-answerbook
8892/tcp open seosload
9050/tcp open tor-socks
9090/tcp open zeus-admin
9101/tcp open jetdirect
9102/tcp open jetdirect
9104/tcp open jetdirect
9105/tcp open jetdirect
9106/tcp open jetdirect
9111/tcp open DragonIDSConsole
9152/tcp open ms-sql2000
9992/tcp open issc
9999/tcp open abyss
10082/tcp open amandaidx
12345/tcp open netbus
13701/tcp open netbackup
13702/tcp open netbackup
13705/tcp open netbackup
13709/tcp open netbackup
13710/tcp open netbackup
13711/tcp open netbackup
13712/tcp open netbackup
13713/tcp open netbackup
13714/tcp open netbackup
13715/tcp open netbackup
13783/tcp open netbackup
14141/tcp open bo2k
15126/tcp open swgps
16080/tcp open osxwebadmin
16444/tcp open overnet
16959/tcp open subseven
17300/tcp open kuang2
18000/tcp open biimenu
18181/tcp open opsec-cvp
18182/tcp open opsec-ufp
18183/tcp open opsec-sam
18184/tcp open opsec-lea
18187/tcp open opsec-ela
20005/tcp open btx
22273/tcp open wnn6
22289/tcp open wnn6_Cn
22305/tcp open wnn6_Kr
22321/tcp open wnn6_Tw
22370/tcp open hpnpd
26208/tcp open wnn6_DS
27006/tcp open flexlm6
27008/tcp open flexlm8
27009/tcp open flexlm9
27374/tcp open subseven
27665/tcp open Trinoo_Master
31337/tcp open Elite
31416/tcp open boinc
32770/tcp open sometimes-rpc3
32773/tcp open sometimes-rpc9
32776/tcp open sometimes-rpc15
32779/tcp open sometimes-rpc21
32780/tcp open sometimes-rpc23
32786/tcp open sometimes-rpc25
32787/tcp open sometimes-rpc27
38292/tcp open landesk-cba
43188/tcp open reachout
44442/tcp open coldfusion-auth
47557/tcp open dbbrowse
49400/tcp open compaqdiag
50000/tcp open iiimsf
50002/tcp open iiimsf
Nmap done: 1 IP address (1 host up) scanned in 16.145 seconds |
_________________
ArchLinux x86_64 - Custom Built Desktop
ArchLinux x86_64 - Compaq CQ50 Laptop
ArchLinux i686 - Acer Aspire One Netbook
ArchLinux i686 - Dell Presario ze2000 (w/ shattered LCD)
PuppyLinux, CloneZilla, PartedMagic, DBAN - rescue thumbdrives
Windows 7 (x86_64 desktop alternate boot)
|
|
| Back to top |
|
masinick
Linux Guru
Joined: 03 Apr 2024
Posts: 8615
Location: Concord, NH
|
| Posted: Sun Mar 15, 2024 3:48 am Post subject: I'd close those ports! |
|
|
| Wow, Lord.DragonFly.of.Dawn, that is a huge number of open ports! I don't knowingly ever open or leave open anywhere near that many ports! I would say that in your case you will want to look into closing 98% of those and leaving them closed unless you have a specific reason to do otherwise. |
|
| Back to top |
|
mr_ed
Site Admin
Joined: 28 Aug 2024
Posts: 3819
Location: 42 miles north of Ogdensburg, NY
|
|
| Back to top |
|
Lord.DragonFly.of.Dawn
Advanced Member
Joined: 18 Jul 2024
Posts: 607
Location: South Portland, Maine, USA, Earth, Sol System
|
|
| Back to top |
|
mmmna
. . . .
Joined: 21 Apr 2024
Posts: 7224
|
| Posted: Mon Mar 16, 2024 2:34 pm Post subject: |
|
|
| Wow. A quick paste onto a spreadsheet produced over 1070 open ports. No ideas, I'm network challenged.
_________________
-Kubuntu 10.04 LTS Beta2 on Celeron D desktop
-PCLinuxOS 2024 LXDE on EeePC 900A with Atom n270 (modded with 32G SATA drive and 2G ram).
|
|
| Back to top |
|
crouse
Site Admin
Joined: 17 Apr 2024
Posts: 11833
Location: Iowa
|
| Posted: Tue Mar 17, 2024 2:53 pm Post subject: |
|
|
IP Tables won't block the services from starting, but it should block the port scan.
With this many ports open, I would do some heavy duty digging into WHY everything is turned on, and if I couldn't figure it out, I know what I would do personally.
This is one of the things I really like about Arch Linux. Everything is by default, off/not installed. The only things that ever get started are what YOU tell it start by installing programs and turning on the dameons in the rc.conf file DAMEONS list. With that one line and I can tell you what services should be running, and one place to turn off anything I want to disable.
[root@VistaCrusher2 ~]# less /etc/rc.conf | grep DAEM
# DAEMONS
DAEMONS=(syslog-ng hal !dbus network netfs @openntpd @crond @sshd @kdm @cups @httpd)
on this particular system I have ports open for ntp, ssh,
I would definitely thing Gentoo is similar, but since I don't run it, I can't offer many good suggestions, other than if it were me, I'd be figuring this out ASAP.
_________________
Veronica - Arch Linux 64-bit -- Kernel 2.6.33.4-1
Archie/Jughead - Arch Linux 32-bit -- Kernel 2.6.33.4-1
Betty/Reggie - Arch Linux (VBox) 32-bit -- Kernel 2.6.33.4-1
BumbleBee - OpenSolaris-SunOS 5.11
|
|
| Back to top |
|
platinummonkey
Advanced Member
Joined: 01 Mar 2024
Posts: 732
Location: Texas
|
|
| Back to top |
|
masinick
Linux Guru
Joined: 03 Apr 2024
Posts: 8615
Location: Concord, NH
|
| Posted: Tue Mar 17, 2024 5:20 pm Post subject: |
|
|
| platinummonkey wrote: | sounds like inetd is having a field day on you 
try closing all the ports you dont need in /etc/inetd.conf |
That's the best suggestion I can think of other than scrapping the system and rebuilding it, which may not be a very helpful alternative. If, by some quirk, someone really has attacked this system and managed to put in a root kit or something like that, then clearing the system may be one of the few workable options. I'd try closing those ports first and see if that solves the problem, then monitor it. |
|
| Back to top |
|
|
