Open Ports problem

[AsianSpices]

Hi
The only service I installed is SSH and TFTP

Does anyone know why the ports
21 - ftp
25-smtp
110-pop3

are open by default? and what are listening on them if the services is not even installed ( Or how can i check to see if the service is installed and running?)

and how to close them?


thanks alot

[wjholden]

That's strange, it looks like you've set up a mailserver. Port 21 is obviously your FTP server. Once you've enabled SSH you'll see port 22 open as well.

Look for a mail server by typing "rc-update show". You can easily stop it with /etc/init.d/<program> stop and can start SSH with /etc/init.d/sshd restart (remember to "rc-update add sshd default" to make it run by default).

I guess you're scanning localhost with nmap?

[tomaw]

First find out what is listening. Port 21 is ftp. Gentoo does not install an ftp server by default, so this is probably something more wacky than that.

To find out what is listening, first emerge lsof then run, as root

[moocha]

Or, if you haven't installed lsof, you can also use

[AsianSpices]

oKIE
Thank You all Very much for the replies, but i scanned my mechine from a remote mechine using nmap and nessus
and i got the same answer. Those 3 ports are open.

By the way
Yes port 22 is open bcuz i enables ssh.
BUt i want to close alll OTher ports.

I check the "rc-update show"
and there is no mail server.

Though there is in.tftp (but i want that- and thats suppose to be port 69 anyway)

So i have no idea, i did a netstat -npl and there is nothing unsual.

I am currently not in the office but when i get back i will post the results.

But how can you close the oprts?
Bcuz i knoe in Redhat you can just do a ntsysv and disable all unwated processes......:S

[moocha]

Again, what is the output of

[christsong84]

[bone]

[jamapii]

Run "netstat -lp" as root to find the name of the program that listens on the ports, then run "grep programname /etc/init.d/*".

Most mail servers have names that don't mean anything (except sendmail). If you don't know what it is, it might be a mail server. The cron daemon needs a mailer.

You can possibly close them in the mailer configuration, or bind to a specific interface (127.0.0.1), or use iptables.

[AsianSpices]

Okie guys,

I did a emerge --info and this is what i got

[moocha]

Your machine has quite clearly been broken into - open ports that don't show up in netstat are a dead giveaway. And my guess is it was a ssh password dictionary attack. The attacker also obviously got root privileges since ports under 1024 can only be opened by root. See my post here for how to react on this: https://forums.gentoo.org/viewtopic-p-2454155.html#2454155
_________________
Military Commissions Act of 2006: http://tinyurl.com/jrcto

"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
-- attributed to Benjamin Franklin

[AsianSpices]

Okie
thanks for the reply,But thats not possible.

We are on our own little network a 192.168.0.x
and the ony time I put it in the company network was to do the nmap to show you guys.

and I am the only one doing any ssh into the mechine.

Even if the "attacker" opened it.....How are they going to do that and HOW can i close it?

[kloune]

Did someone suggested to install rkhunter or thelike ? It's easy to use and to install. Just emerge it and run

[moocha]

[christsong84]

[AsianSpices]

[christsong84]

[AsianSpices]

Yes my ip tables is setup to drop all connections/close all ports except the ones you specified

[christsong84]

[limn]

Is it possible that your nmap is running against a different machine than the one in question? What is the output of ifconfig on the target box?

[christsong84]

[AsianSpices]

Okie guys,

I figured out what was wrong
Packages such as vixie-cron and tripwire automatically installs the mail services as their dependencies.
Hece the reason the ports were open.

So my question is how do i close the ports now
seeing that i cannot even see the mail services installed....

But on another note..
My boss wants me to install ceratin packages
such as lets say TfTP and Net-SNMp but he wants them done networkless.

I downloaded the tar files but i dont know how to install them
tar -xvjf <package name>
make
make install
does not do it


does emerge work for this?
Can anyone help me Please

[christsong84]

step 1: type in "emerge -p packagename" without the quotes and download the version mentioned
step 2: download package and get it to the computer somehow
step 3: put it un /usr/portage/distfiles/ (yes the whole tarball...not unzipped or anything)
step 4: type in "emerge packagename" without the quotes
step 5: watch the compile work

that's how it should work
_________________
while(true) {self.input(sugar);}

[AsianSpices]

Okie i got that part
The thing is i cannot find anywhere to dload a *.tbz2 files for tripwire , net-snmp and tftp

I found teh one for iptables and it worked . tank god!

Does anone knoe of a link for this?

[overkll]