I ran port scanner on my machine and I see it's listening to port 110 (POP3). I'm not sure how I can disable this port. Thanks
2 Answers
You can block port 110 immediately with
sudo /sbin/iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 110 -j DROP
sudo /sbin/iptables -I RH-Firewall-1-INPUT -p udp -m udp --dport 110 -j DROP
To do it permanently you need to figure out what is actually listening and either disable or remove it. To find what is listening on the port use
netstat -lnp | grep 110
amongst the output you'll get something similar to
tcp 0 0 :::110 :::* LISTEN 28179/dovecot
I have dovecot running pop3 on port 110. I can see how it's configured to run with
chkconfig --list dovecot
dovecot 0:off 1:off 2:off 3:on 4:on 5:on 6:off
Which shows it will start at runlevels 3,4,5. You can disable it with
chkconfig dovecot off
The service can be stopped running immediately with
/sbin/service dovecot stop
Stopping Dovecot Imap: [ OK ]
You may have different processes listening on your port so the above instructions may not be exactly correct but hopefully you'll get the gist of it.
Find out what is listening on that port with netstat -lp
as root (or sudo netstat -lp
as a non-root user with privileged access via sudo) and uninstall (or just disable) that service.
If you have services running (and listening for outside connections) that you did not explicitly install and configure, take care as you may have been hacked (at which point the only safe course of action is to backup the data on the machine, reinstall the OS, and start afresh with the data from your backups).