LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 09-27-2004, 11:58 AM   #1
race
Member
 
Registered: Nov 2003
Distribution: debian
Posts: 66

Rep: Reputation: 15
Port Openings


OK quick question... sometimes when i randomly nmap my machine there are weird ports open, which right after i nmap the machine are closed. Today for example i ran nmap and got
(The 1549 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
113/tcp open auth
515/tcp open printer
1380/tcp open telesis-licman
10000/tcp open snet-sensor-mgmt


and then i reran the scan less then 5 seconds after the completion of the other scan and i got

(The 1549 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
113/tcp open auth
515/tcp open printer
10000/tcp open snet-sensor-mgmt


I assume this is a security problem b/c I have no idea what these new ports are and i have no use for them. The other time that i noticed this happening the "service name" was genie. I dont remeber if the port # was the same.
 
Old 09-30-2004, 09:55 AM   #2
race
Member
 
Registered: Nov 2003
Distribution: debian
Posts: 66

Original Poster
Rep: Reputation: 15
found another strange port that was open for a moment and then closed the next:

1520/tcp open atm-zip-office


weird stuff
 
Old 10-01-2004, 05:41 PM   #3
Krugger
Member
 
Registered: Oct 2004
Posts: 229

Rep: Reputation: 30
It could be either your traffic that is generating those results if it is one of the more exotic scan options.

It could be some weird guy spoffing and ACK if it is a SYN scan.

Or it is a rootkit that uses port knocking or a time based mechanism. Check for a raw socket on that computer and have a look at the logs. Although it would be pretty stupid to set the hidden comunication port in one of the ports that nmap scans by default.

Try also extending the port range to cover the whole port range. Or do a netstat -a, that shows what is open at the moment. Assuming the rootkit doesn't mess with the result.
 
Old 10-01-2004, 10:26 PM   #4
sh1ft
Member
 
Registered: Feb 2004
Location: Ottawa, Ontario, Can
Distribution: Slackware, ubuntu
Posts: 391

Rep: Reputation: 31
The port 10000 is webmin, you may _really_ want to investigate that if you did not install it on your machine.

Last edited by sh1ft; 10-01-2004 at 10:28 PM.
 
Old 10-02-2004, 08:56 PM   #5
race
Member
 
Registered: Nov 2003
Distribution: debian
Posts: 66

Original Poster
Rep: Reputation: 15
thanks for the replies

first: I know webmin is running on 10000. I have installed it to make configuring ssh, apache, and mysql a little easier.

second: i installed chkrootkit from apt-get and it did not notice any sort of root kits.

third: i ran netstat, it seems all normal.

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 debianBox:ssh windowsMachine:3704 ESTABLISHED
tcp 0 0 *:10000 *:* LISTEN
tcp 0 0 *:www *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:auth *:* LISTEN
udp 0 0 *:10000 *:*
udp 0 0 *:bootpc *:*
raw 0 0 *:icmp *:* 7
raw 0 0 *:tcp *:* 7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 97 /dev/log
unix 1 [ W ] STREAM CONNECTED 15692
unix 1 [ ] STREAM CONNECTED 15691
unix 0 [ ] DGRAM 1763
unix 0 [ ] DGRAM 101

since all this stuff seems normal.. is my best solution to get iptables up and running??
 
Old 10-02-2004, 09:11 PM   #6
race
Member
 
Registered: Nov 2003
Distribution: debian
Posts: 66

Original Poster
Rep: Reputation: 15
wtf squid-http????



i have uninstalled internet service that i had that was using a port.. ideally i only want 22 open for ssh.


Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ )
Strange read error from debianBoxIP (104): Operation now in progress
Strange read error from debianBoxIP (104): Operation now in progress
Strange read error from debianBoxIP (104): Operation now in progress
Interesting ports on debianBoxIP (debianBoxIP):
(The 64995 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
113/tcp open auth
3128/tcp open squid-http
3646/tcp open unknown
4155/tcp open unknown


also if you look at:


Nmap run completed -- 1 IP address (1 host up) scanned in 9 seconds
me@Debian:~$ ps -aux
Bad syntax, perhaps a bogus '-'?
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.3 1272 488 ? S Oct01 0:07 init [2]
root 2 0.0 0.0 0 0 ? SW Oct01 0:00 [kflushd]
root 3 0.0 0.0 0 0 ? SW Oct01 0:05 [kupdate]
root 4 0.0 0.0 0 0 ? SW Oct01 0:00 [kswapd]
root 5 0.0 0.0 0 0 ? SW Oct01 0:00 [keventd]
root 119 0.0 0.6 2164 844 ? S Oct01 0:00 /sbin/dhclient-2.
root 173 0.0 0.6 2036 780 ? S Oct01 0:04 /sbin/syslogd
root 176 0.0 0.7 1716 920 ? S Oct01 0:00 /sbin/klogd
root 184 0.0 0.5 1988 704 ? S Oct01 0:00 /usr/sbin/inetd
root 196 0.0 0.9 2784 1208 ? S Oct01 0:00 /usr/sbin/sshd
root 203 0.0 0.5 1652 684 ? S Oct01 0:00 /usr/sbin/cron
root 210 0.0 0.3 1252 468 tty1 S Oct01 0:00 /sbin/getty 38400
root 211 0.0 0.3 1252 468 tty2 S Oct01 0:00 /sbin/getty 38400
root 212 0.0 0.3 1252 468 tty3 S Oct01 0:00 /sbin/getty 38400
root 213 0.0 0.3 1252 468 tty4 S Oct01 0:00 /sbin/getty 38400
root 214 0.0 0.3 1252 468 tty5 S Oct01 0:00 /sbin/getty 38400
root 215 0.0 0.3 1252 468 tty6 S Oct01 0:00 /sbin/getty 38400
root 3543 0.0 0.5 2044 744 ? S 06:47 0:00 /usr/sbin/lpd
root 4012 0.1 1.4 6396 1884 ? S 13:13 0:00 /usr/sbin/sshd
me 4014 0.1 1.5 6404 1968 ? S 13:13 0:00 /usr/sbin/sshd
me 4015 0.0 0.9 2212 1220 pts/0 S 13:13 0:00 -bash
identd 4020 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4021 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4022 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4023 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4024 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4025 0.0 0.5 11732 688 ? S 13:14 0:00 identd
identd 4026 0.0 0.5 11732 688 ? S 13:14 0:00 identd
me 4029 0.0 0.9 3160 1244 pts/0 R 13:14 0:00 ps -aux
me@Debian:~$

its all quiet on the western front..........

Last edited by race; 10-03-2004 at 12:25 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
PLESK [Solution] Change port to 23 (telnet) instead of default port 8443 x5452 Linux - Software 6 05-10-2009 05:58 AM
linux serial port to router console port connection? frankie_fix Linux - General 3 02-26-2007 09:32 PM
Using serial port card(PCMCIA) with IPAQ running Linux, can't find ttyS0 port d2army Linux - Laptop and Netbook 0 11-12-2005 08:07 PM
cannot SFTP to SUSE 9.2 box, port 22 open, can putty in though using same port. jgrady Linux - Networking 6 03-29-2005 08:44 AM
--destination-ports port[,port[,port...]] KevinGuy Linux - Networking 1 03-16-2004 06:06 PM


All times are GMT -5. The time now is 01:46 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration