How to disable particular port on centos

SinclairJ · 10-04-2012, 09:36 AM

I want to disable a specific port on a centos base server.
I have already try disable port from csf and iptables by adding drop rule. But it does not work out for me. Does any one know any other way or the exact process if I done it by wrong method.

Thanks in advance.
Sinclair J

MensaWater · 10-04-2012, 11:51 AM

dropping traffic and disabling a port aren't the same thing.

What port?

Is this inbound to your machine? Outbound from it?

Why are you trying to "disable" it?

If you run "lsof -i :<port>" for the port in question do you see anything on it?

What exactly do you have in your iptables configuration (entire config - not just the line you think should have fixed it - location in the rules makes a difference).

If you have a service listening on a given port rather than creating rules to drop traffic to it there would be more sense in simply NOT starting that service.

What version of CentOS (cat /etc/issue)?

If you tell us the answer to the above questions we may be able to give you better answers.

SinclairJ · 10-04-2012, 12:06 PM

Thanks for reply,

centos version is
cat /etc/redhat-release
CentOS release 6.3 (Final)

I want to disable 2086 port no, So no one can access my WHM panel through insecure connection.

lsof -i:2086
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cpsrvd-do 24115 root 4u IPv4 740338056 0t0 TCP *:2086 (LISTEN)

Regards,
Sinclair J.

rosehosting.com · 10-04-2012, 12:42 PM

hi,

port 2086 do not use 'ssl', but you can force your users to use secure connection by selecting the 'always redirect to ssl' under the 'tweak settings' in your whm at https://your-domain.tld:2087.

hope that's what you wanted to achieve.

MensaWater · 10-04-2012, 02:01 PM

So you didn't post your iptables setup.

If you run "service iptables status" what does it show?

Essentially if you have iptables turned on and have NOT opened a given port it is by default closed to use on anything other than "localhost". That is because by default both the INPUT and FORWARD chains reject everything as last rule and you have to insert rules to open things:

Code:

Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:5432
6    ACCEPT     tcp  --  192.168.1.1          0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:5666
7    ACCEPT     tcp  --  192.168.1.5          0.0.0.0/0           state NEW,ESTABLISHED tcp dpts:666
8    ACCEPT     tcp  --  192.168.1.7          0.0.0.0/0           state NEW,ESTABLISHED tcp dpts:667
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:13724
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:1311
11   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:13782
12   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:1556
13   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED tcp dpt:5433
14   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

The above ruleset specifically allows certain IPs to get to certain ports and allows everyone to get to others (e.g. port 22) but any port NOT allowed before the REJECT line will not be accessible because that rule says to reject everything. Also as an alternative to rejecting the port completely you can do as is seen for port 5666 for example and allow only one IP to reach it - all other IPs would get rejected. You can also set restrictions to certain networks/subnets.

Rose's idea may be a better one for what you want to achieve. I've not done this in a WHM/Cpanel setup.

SinclairJ · 10-05-2012, 04:55 AM

Thanks again,

I tried to reject 2086 port for all ips and add this rule

DROP tcp -- default anywhere tcp dpt:2086
DROP tcp -- default anywhere tcp dpt:2086
DROP tcp -- anywhere anywhere tcp dpt:2086
DROP udp -- anywhere anywhere udp dpt:2086
REJECT tcp -- anywhere anywhere tcp dpt:2086 reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:2086 reject-with icmp-port-unreachable

But still whm page get access. So what should I do to get this thing right.

Regards,
Sinclair J.

MensaWater · 10-05-2012, 09:21 AM

Again - please post your ENTIRE iptables output. The location of the rules makes a difference and by simply showing us a subset means we can't determine if you have placed them properly.

Also you shouldn't need both "DROP" and "REJECT" for the same port. You can combine udp/tcp into one by using "all" rather than specifying "tcp" and "udp" on the separate lines.

Also did you try what Rose wrote?

henrycoffin · 10-05-2012, 09:30 AM

Where have you added those iptables rules? Have you reloaded iptables once the rules have been added?

Easiest way would be to run something like

# iptables -I INPUT 'line number you want to insert the rule' -p tcp --dport 2086 -j REJECT

do the same for udp and the run service iptables save to save across reboots!

MensaWater · 10-05-2012, 09:48 AM

Quote:

Originally Posted by henrycoffin

# iptables -I INPUT 'line number you want to insert the rule' -p tcp --dport 2086 -j REJECT

The insert is a good way to do things but "line number you want to insert" is very important. Typically you have to determine the number of lines in the specific chain (e.g. INPUT chain) then insert no less than TWO lines above the last line there for proper placement.

Since the OP isn't letting us know his full setup its difficult to say where he has the rules.

Also we haven't talked about ip6tables - it is barely possible he has IPV6 accessibility and is somehow tripping on that.

SinclairJ · 10-05-2012, 11:49 AM

Thank you for everyone , specially MensaWater.

# iptables -I INPUT 'line number you want to insert the rule' -p tcp --dport 2086 -j REJECT

I have tried this. One more thing I have notice improper sequence of accept and reject rule. Then I reload iptables rule, Now my problem is get resolved.

Please clear my one more doubt, IF server have csf then whether it get stuck with iptables rule while working or not. Because when I flush iptables rule server get hang for me.

Thanks in advance.

Regards,
Sinclair J.

MensaWater · 10-05-2012, 12:05 PM

I'm not familiar with CSF so can't offer assistance on that.