up vote 1 down vote favorite
share [g+] share [fb]

I have a VPS box I just purchased. It is running Apache and SSHD on their default ports.

When I do a port scan, I get results back that say port 139 and various other seemingly random ports are open. I am not running any services that would use these ports. The VPS provider provides console access over VNC.

iptables is running, and the rules are here:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere            state INVALID
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state    NEW
OPEN-UDP   udp  --  anywhere             anywhere            state NEW
OPEN-TCP   tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN state NEW
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain OPEN-TCP (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http

Chain OPEN-UDP (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere            udp dpt:http

EDIT:

The result from James suggestion in comments (netstat -anp | grep LISTEN | grep tcp):

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -

I have postgres running, but only accepting connections from localhost.

Are these ports open because of the VNC software my VPS is providing (aka is this common?) or is it something I am doing wrong or have I been rooted?

link|improve this question
Hey can you run the following command and send back the results ` netstat -anp | grep LISTEN | grep tcp` – James Mar 10 '11 at 17:26
What distro are you using? Various distros have different default firewall confs. – ajdecon Mar 10 '11 at 17:36
@ajdecon, Arch Linux. I had to configure iptables myself – vpn_noobe Mar 10 '11 at 18:30
@James, see my edit please – vpn_noobe Mar 10 '11 at 18:30
Eh, netstat does not list any VNC ports, 5900, I believe. If the IP number assigned to this box actually answers VNC, there seem to be some packet rewriting going on. In that case, perhaps port 139 is rewritten as well? – Bittrance Mar 10 '11 at 18:51
show 2 more comments
feedback

1 Answer

up vote 0 down vote

Port 139 is a registered port for Windows file/printer sharing. Check to see if samba is running ps aux | grep smb

link|improve this answer
Samba is not running or even installed – vpn_noobe Mar 10 '11 at 18:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.