1

I ran port scanner on my machine and I see it's listening to port 110 (POP3). I'm not sure how I can disable this port. Thanks

2 Answers 2

4

You can block port 110 immediately with

sudo /sbin/iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 110 -j DROP
sudo /sbin/iptables -I RH-Firewall-1-INPUT -p udp -m udp --dport 110 -j DROP

To do it permanently you need to figure out what is actually listening and either disable or remove it. To find what is listening on the port use

netstat -lnp | grep 110

amongst the output you'll get something similar to

tcp    0   0 :::110             :::*                LISTEN      28179/dovecot

I have dovecot running pop3 on port 110. I can see how it's configured to run with

chkconfig --list dovecot
dovecot         0:off   1:off   2:off   3:on    4:on    5:on    6:off

Which shows it will start at runlevels 3,4,5. You can disable it with

chkconfig dovecot off

The service can be stopped running immediately with

/sbin/service dovecot stop 
Stopping Dovecot Imap:                                     [  OK  ]

You may have different processes listening on your port so the above instructions may not be exactly correct but hopefully you'll get the gist of it.

0
1

Find out what is listening on that port with netstat -lp as root (or sudo netstat -lp as a non-root user with privileged access via sudo) and uninstall (or just disable) that service.

If you have services running (and listening for outside connections) that you did not explicitly install and configure, take care as you may have been hacked (at which point the only safe course of action is to backup the data on the machine, reinstall the OS, and start afresh with the data from your backups).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .