Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a VPS box I just purchased. It is running Apache and SSHD on their default ports.

When I do a port scan, I get results back that say port 139 and various other seemingly random ports are open. I am not running any services that would use these ports. The VPS provider provides console access over VNC.

iptables is running, and the rules are here:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere            state INVALID
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state    NEW
OPEN-UDP   udp  --  anywhere             anywhere            state NEW
OPEN-TCP   tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN state NEW
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain OPEN-TCP (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http

Chain OPEN-UDP (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere            udp dpt:http

EDIT:

The result from James suggestion in comments (netstat -anp | grep LISTEN | grep tcp):

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -

I have postgres running, but only accepting connections from localhost.

Are these ports open because of the VNC software my VPS is providing (aka is this common?) or is it something I am doing wrong or have I been rooted?

share|improve this question
    
Hey can you run the following command and send back the results ` netstat -anp | grep LISTEN | grep tcp` –  James Mar 10 '11 at 17:26
    
What distro are you using? Various distros have different default firewall confs. –  ajdecon Mar 10 '11 at 17:36
    
@ajdecon, Arch Linux. I had to configure iptables myself –  vpn_noobe Mar 10 '11 at 18:30
    
@James, see my edit please –  vpn_noobe Mar 10 '11 at 18:30
    
Eh, netstat does not list any VNC ports, 5900, I believe. If the IP number assigned to this box actually answers VNC, there seem to be some packet rewriting going on. In that case, perhaps port 139 is rewritten as well? –  Bittrance Mar 10 '11 at 18:51

1 Answer 1

Port 139 is a registered port for Windows file/printer sharing. Check to see if samba is running ps aux | grep smb

share|improve this answer
    
Samba is not running or even installed –  vpn_noobe Mar 10 '11 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.