Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I check if a port is open or closed on a Linux server (running Cent OS 5 and cPanel) using SSH?

EDIT: And how can I open the port if it is closed?

Thanks,

James

share|improve this question
10  
SSH is a protocol, not a TCP diagnostic tool. –  Shane Madden Sep 7 '11 at 17:28
    
Just to be clear. Are you asking how to with ssh from a remote system, or how to check while you are connected to a system via ssh? –  Zoredache Sep 7 '11 at 17:30
    
It's not quite clear what you're asking. What do you mean by "open"? Do you mean some server is listening on that port? Or do you mean it's allowed by the system firewall? Or what? –  David Schwartz Sep 7 '11 at 17:47
    
I think a port is being blocked on my server and want to unblock/open it again. –  James Anderson Sep 7 '11 at 17:49
1  
netstat -an | grep PORTNUMBER | grep -i listen If the output is empty, the port is not in use. –  automatix Sep 28 '13 at 13:12
add comment

9 Answers

up vote 28 down vote accepted

You can check if a process listens on a TCP or UDP port with netstat -tuplen.

To check whether some ports are accessible from the outside (this is probably what you want) you can use a port scanner like Nmap from another system. Running Nmap on the same host you want to check is quite useless for your purpose.

share|improve this answer
    
There's no such thing as "tuplen" There is -t though. Also easier way than nmap is to just use Telnet. –  Dexter Apr 25 '13 at 17:20
4  
GNU netstat knows the parameters -t, -u, -p, -l, -e, and -n. Thanks to the options parser it can be expressed as -tuplen. linux.die.net/man/8/netstat –  joschi Apr 26 '13 at 9:53
    
Also, the telnet command usually does only supports TCP, so you're out of luck if the service you want to check runs on another protocol. –  joschi Apr 26 '13 at 9:55
    
yeah, I was using windows hence the confusion. –  Dexter Apr 27 '13 at 15:42
1  
nc is (better) alternative to telnet. It supports UDP too. –  tsv.dimitrov Jul 10 '13 at 8:42
add comment

within the ssh terminal session, use

netstat -aux

To find the process that's bound to a specific port use

netstat -auxn | grep :22 (where 22 is a given port number)

share|improve this answer
    
Hi, didn't do anything when I put in "netstat -auxn | grep :xxxx" –  James Anderson Sep 7 '11 at 17:30
    
I don't understand what you mean. grep is to parse the output of a command... what happens when you just type netstat -auxn? –  mbrownnyc Sep 7 '11 at 17:31
    
@James, Can you give us the exact number you put after the colon? –  Wesley Sep 7 '11 at 17:32
1  
2196 and I did another one with 2195. –  James Anderson Sep 7 '11 at 17:38
    
Can you please clarify if you're running these on the client or the server? What exactly are you trying to check, and from where? –  cjc Sep 7 '11 at 17:42
show 4 more comments

If you're referring to external banner grabbing, you cannot do that with SSH like you can Telnet. If you're referring to inner system port checking, mbrownnyc has a good answer.

EDIT:

You open a port by running a service / application that listens on that port. Ports aren't opened without a reason (i.e. without a listening service). You could also edit iptables to redirect traffic from one desired port to a daemon listening on another port.

share|improve this answer
add comment

Quickest way to test if a TCP port is open (including any hardware firewalls you may have), is to type, from a remote computer (e.g. your desktop):

telnet myserver.com 80

Which will try to open a connection to port 80 on that server. If you get a time out or deny, the port is not open :)

share|improve this answer
    
says that it doesn't recognise "telnet" as a command... –  James Anderson Sep 7 '11 at 17:37
2  
"yum install telnet" to install the telnet client package. –  cjc Sep 7 '11 at 17:41
    
Says: telnet: connect to address 82.165.148.224: Connection refused –  James Anderson Sep 7 '11 at 17:42
4  
Written above: if you get a time out or deny, the port is not open –  Industrial Sep 7 '11 at 18:09
    
What if you don't have perms to install telnet? Is there another standard tool? –  KC Baltz Jan 14 at 23:40
add comment

If you are connected to the system and can run a command as root then you can check the ooutput of iptables

iptables -L -vn

this will list the firewall rules and which ports are open target ACCEPT and any explicitly closed ports target REJECT.

share|improve this answer
add comment

OK, in summary, you have a server that you can log into. You want to see if something is listening on some port. As root, run:

netstat -nlp

this will show a listing of processes listening on TCP and UDP ports. You can scan (or grep) it for the process you're interest in,and/or the port numbers you expect to see.

If the process you expect isn't there, you should start up that process and check netstat again. If the process is there, but it's listening on a interface and port that you did not expect, then there's a configuration issue (e.g., it could be listening, but only on the loopback interface, so you would see 127.0.0.1:3306 and no other lines for port 3306, in the case of the default configuration for MySQL).

If the process is up, and it's listening on the port you expect, you can try running a "telnet" to that port from your Macbook in your office/home, e.g.,

 telnet xxxxxxxxxxxx.co.uk 443

That will test if (assuming standard ports) that there's a web server configured for SSL. Note that this test using telnet is only going to work if the process is listening on a TCP port. If it's a UDP port, you may as well try with whatever client you were going to use to connect to it. (I see that you used port 224. This is masqdialer, and I have no idea what that is).

If the service is there, but you can't get to it externally, then there's a firewall blocking you. In that case, run:

 iptables -L -n

This will show all the firewall rules as defined on your system. You can post that, but, generally, if you're not allowing everything on the INPUT chain, you probably will need to explicitly allow traffic on the port in question:

 iptables -I INPUT --dport 224 -j ACCEPT

or something along those lines. Do not run your firewall commands blindly based on what some stranger has told you on the Internet. Consider what you're doing.

If your firewall on the box is allowing the traffic you want, then your hosting company may be running a firewall (e.g., they're only allowing SSH (22/tcp), HTTP (80/tcp) and HTTPS (443/tcp) and denying all other incoming traffic). In this case, you will need to open a helpdesk ticket with them to resolve this issue, though I suppose there might be something in your cPanel that may allow it.

share|improve this answer
    
Could you pls add how to undo the iptables -I command? Thanks!! –  Evgeny Sep 9 '13 at 22:52
1  
"iptables -D" followed by whatever else you had after the "-I" in the original command. Basically, look up the documentation. –  cjc Sep 10 '13 at 11:45
add comment

You have cPanel in your server, so you can install CSF+LFD or APF+BFD (with any additional plugin for APF WHM Interface). Once they are installed, you can simply manage the firewall (allow IPs, deny IPs, open ports, close ports..etc and much more) from your WHM >> Plugins section itself. These firewalls will also take care of some other security concerns such as brute force attacks, dos attacks etc.

http://configserver.com/cp/csf.html

http://www.rfxn.com/projects/

share|improve this answer
add comment

The best possible solution is:

ssh <IP or hostname> -p <port>

eg ssh localhost -p 8080

share|improve this answer
1  
That isn't a very good solution at all. SSH is a horrid tool for checking for open ports. –  Falcon Momot Jun 19 '13 at 0:00
1  
+1. However silly, it does answer the question that the OP asked, unlike most of the others. –  mc0e Jun 19 '13 at 0:48
add comment

Firstly, as noted by many, ssh may be a poor choice of tool for this task. I could imagine a scenario where it makes sense though, if ssh is the only port you can reach, but you want to tunnel through that to test ports on the remote end of the connection. Fortunately ssh provides some good tunnelling capabilities.

To do this, you can use ssh's socks proxy, and use proxychains to tunnel connections from a tool like nmap through the socks proxy.

When I install proxychains on ubuntu, it uses port 9050 by default (configured in /etc/proxychains.conf). YMMV - configure proxychains if needed.

ssh -D 9050 remote.sshhost.net

In another shell, run your scan:

proxychains nmap -sT -P0 -p 22,25,80 127.0.0.1

In the above example you're scanning localhost ports on remote.sshhost.net, not on your local machine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.