Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have recently installed two Ubuntu Server machines and I would like to find the open ports in the machine.

When I run nmap from my machine (Ubuntu 11.10) I observed that both servers have

135/tcp  filtered msrpc
4444/tcp filtered krb524
4662/tcp filtered edonkey
5000/tcp filtered upnp
5631/tcp filtered pcanywheredata

I have never opened those ports. I only installed LAMP and SAMBA. Why are these ports open?

The complete list of the open ports are:

22/tcp  open  ssh
25/tcp  open  smtp
53/tcp  open  domain
80/tcp  open  http
110/tcp open  pop3
135/tcp  filtered msrpc
139/tcp  open     netbios-ssn
143/tcp  open     imap
445/tcp  open     microsoft-ds
993/tcp  open     imaps
995/tcp  open     pop3s
4444/tcp filtered krb524
4662/tcp filtered edonkey
5000/tcp filtered upnp
5631/tcp filtered pcanywheredata

The question is why are these ports open: 135/tcp filtered msrpc, 4444/tcp filtered krb524, 4662/tcp filtered edonkey. 5000/tcp filtered upnp, 5631/tcp filtered pcanywheredata. I have never opened those ports. I only installed LAMP and SAMBA.

Does that list seem secure?

share|improve this question

4 Answers 4

up vote 5 down vote accepted

You can get list of ports from file called /etc/services

cat /etc/services | grep 137 (example)

Example

What ports need to be open for Samba to communicate

netbios-ns - 137 # NETBIOS Name Service

netbios-dgm - 138 # NETBIOS Datagram Service

netbios-ssn - 139 # NETBIOS session service

microsoft-ds - 445 # if you are using Active Directory

run this command netstat -anltp | grep "LISTEN"

The typical web server which runs FTP, SSH, and MySQL will have output like:

tcp     0   0 127.0.0.1:3306    0.0.0.0:*   LISTEN   21432/mysqld
tcp     0   0 0.0.0.0:80        0.0.0.0:*   LISTEN   4090/apache2
tcp     0   0 0.0.0.0:22        0.0.0.0:*   LISTEN   7213/sshd
tcp6    0   0 :::21             :::*        LISTEN   19023/proftpd
tcp6    0   0 :::22             :::*        LISTEN   7234/sshd
share|improve this answer
1  
My server lists the following pastebin.com/y6EEeTPr. What is cupsd ? –  ntenisOT Jan 28 '12 at 18:16
2  
The primary mechanism for Ubuntu printing and print services is the Common UNIX Printing System (CUPS). help.ubuntu.com/8.04/serverguide/C/cups.html <..> manpages.ubuntu.com/manpages/hardy/man8/cupsd.8.html –  One Zero Jan 28 '12 at 18:24

This command will help you.

$ netstat -a -n | egrep 'Proto|LISTEN'
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN     
tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN    

This link "open ports and listening services commands" will help you.

share|improve this answer

"filtered" doesn't necessarily equate to an open port on the target host.

In fact, it might mean nothing at all.

If, for example, there is a firewall in between wherever you're running nmap and the target, and that firewall is actively filtering out port 5000, then 5000 will appear as "filtered" in your list, without the target host ever seeing any traffic to that port - so whether or not the port is open on the target becomes utterly irrelevant.

For a definitive list of open ports on a server, try:

sudo netstat -lnp --tcp --udp

-l : only show listening ports
-n : don't bother looking up DNS hostnames
-p : show which processes have the port open
--tcp : show tcp ports
--udp : show udp ports

You could omit --tcp and --udp but then you'll get quite a lot of irrelevant local filesystem socket info which is inaccessible over a network.

sudo is required for -p to work properly, or it will just print - for any process not owned by your user.

share|improve this answer
    
Yes you are right. It might be a firewall. Can you check the list in pastebin.com/v6Y2QgCD and let me know how can I find why and which program is using each port? –  ntenisOT Jan 28 '12 at 18:06
1  
I edited my answer to add the -p flag, which will print the process on each line also. Note that you will need to be root (prefix it with sudo) to see any process not owned by your user. –  Caesium Jan 28 '12 at 19:59

Your question is quite broad, and "secure" is relative.

When you install a server, and open a port, there are always going to be potential vulnerabilities.

When you install a server (ssh , samba) , and start the server (they usually start by default when you boot) you open a port.

With each server (ssh, samba, http) there are configurations changes you can make to increase security.

for ssh this could include using keys (and disabling passwords), tcpwrapper, a firewall, etc.

When using a firewall there are 3 broad strategies

1) Allow all and black list bad acting IP. An example of this would be http. In gerneral you run http as a public server, allow all IP, and black list those who spam your server.

2) Deny all and allow a white list. An example of this would be ssh.

3) Limit. Sometime you limit the rate of a connection or # pings / second.

Hope that gets you started, you might want to see

https://help.ubuntu.com/11.10/serverguide/C/index.html

https://help.ubuntu.com/community/Security

Or ask a specific question about a specific server.

share|improve this answer
    
The question is why are these ports open: 135/tcp filtered msrpc, 4444/tcp filtered krb524, 4662/tcp filtered edonkey. 5000/tcp filtered upnp, 5631/tcp filtered pcanywheredata. I have never opened those ports. I only installed LAMP and SAMBA. –  ntenisOT Jan 28 '12 at 16:32
    
They were opened by the servers you installed. 135 is samba. Not sure about the rest. On the server run sudo lsof -i -n -P –  bodhi.zazen Jan 28 '12 at 16:49
    
It does not show those.. –  ntenisOT Jan 28 '12 at 17:02
    
You are going to have to post more information , probably pastebin. Where did you run what command from ? Are you scanning your router ? You are going to have to provide specific details about what you have installed, your network, and the exact output of commands you run if you wish people to provide feedback. "It does not show those" == "I do not know what to tell you". –  bodhi.zazen Jan 28 '12 at 17:06
    
+1 for explaining that filtered might can still mean closed. I was already freaking out having those "crazy windows service" ports open on my ubuntu setup. Yet not finding any service/process via top -bn1 nor via netstat -tuandp. Now I feel saver again –  humanityANDpeace Mar 1 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.