I have a VPS box I just purchased. It is running Apache and SSHD on their default ports.
When I do a port scan, I get results back that say port 139 and various other seemingly random ports are open. I am not running any services that would use these ports. The VPS provider provides console access over VNC.
iptables is running, and the rules are here:
Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere state INVALID ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere icmp echo-request state NEW OPEN-UDP udp -- anywhere anywhere state NEW OPEN-TCP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN state NEW REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere reject-with tcp-reset REJECT all -- anywhere anywhere reject-with icmp-proto-unreachable Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain OPEN-TCP (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:http Chain OPEN-UDP (1 references) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:ssh ACCEPT udp -- anywhere anywhere udp dpt:http
The result from James suggestion in comments (
netstat -anp | grep LISTEN | grep tcp):
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN -
I have postgres running, but only accepting connections from localhost.
Are these ports open because of the VNC software my VPS is providing (aka is this common?) or is it something I am doing wrong or have I been rooted?