Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

all.

I'm desperately trying to pass a Security Metrics test, I've been trying for a few days, but I 'm always left with the same problem:

NetBIOS available on Linux Service: netbios-ssn Port 139 open on Linux machine

I've been googling to no avail.

I've been trying to close port 139 and 445 with both iptables and fuser -k, but it still reports as open (to Security Metrics at least). I've also tried to uninstall Samba and mess with the config file, there's just no way.

Any idea?!

Not sure what else to try...

Any help appreciated.

share|improve this question
1  
What's the output of sudo netstat -tanp? –  growse Feb 7 '12 at 22:21
    
Is the server you are testing behind a NAT ? Maybe the test is seeing another machine behind that NAT ? Did you try to run nmap on the machine ? What is that saying ? –  Tonny Feb 7 '12 at 22:27
    
check /etc/inetd.conf for netbios-ssn entry (which usually runs nmbd) –  yarek Feb 7 '12 at 22:27
    
@yarek I don't have that file... I have xinetd.conf but I don't see anything that could be related to it. :-) –  trapach Feb 8 '12 at 0:28
    
@Tonny yes, nmap says port is closed using both localhost and the ip address... –  trapach Feb 8 '12 at 0:29

4 Answers 4

Double check the IP/hostname they're scanning. Does it match yours? Do an external scan of your own, with nmap, to see if the port is open:

nmap -p 139 hostname (or IP)

If you still have difficulties, enlist the help of your web host (if you use one). Most web hosts will help you secure your site per the PCI scan vendor's specifications, or at least point in the direction to get it fixed.

share|improve this answer
    
localhost says: rDNS record for 127.0.0.1: localhost.localdomain PORT STATE SERVICE 139/tcp closed netbios-ssn –  trapach Feb 8 '12 at 0:23
    
same thing using ip address. port is closed, looks like it reports open... –  trapach Feb 8 '12 at 0:26
    
You're scanning locally? Scan from a remote location to the public interface; this is the same interface your PCI scan vendor is scanning. –  laebshade Feb 16 '12 at 1:43

If you're trying to achieve PCI-DSS compliance and are stuck on this, then I think you need more help then a few answers here. There are some very good, free online training materials - I would recommend the rute as a good starting point. You should also read and apply the SANS Linux checklist.

I've been trying for a few days

What have you tried?

I've also tried to uninstall Samba

What have you tried?

netbios-ssn Port 139 open on Linux machine

The first thing to check is if it really is netbios. As growse says netstat -natp will show you which program is listening on the port. If it is nmbd, then you need to shutdown the server and make sure it never starts again (i.e. uninstall everything you don't need).

The advice given by user171212 will probably work (it'll stop the service) but it's not the right way to control services. For sysV init files, it would be more correct to stop the service and remove the relevant links from the /etc/rc.d/rc*.d but the correct way to do it is via the chkconfig command. Indeed that "Security Metrics" recommends such an approach makes me think that any advice / service they provide should be treated with extreme prejudice.

share|improve this answer

if you dont use samba that much, just disable the service!! that should take care of you problem, but if it doesnt work, there is a really long procedure involving some scripting and stuff, so better try the first one!!

share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  gharper Jul 16 '13 at 16:06

from Security Metric's own page on the subject:

To Permanently disable (RedHat):
1. cd /etc/rc.d/init.d/
2. smb stop
3. mv smb no.smb
(ports 137 & 138 will also be closed)

Reference: https://www.securitymetrics.com/howtos/139.adp

share|improve this answer
    
This is not how to stop/disable the service - see answer elsewhere. –  symcbean Apr 25 '13 at 20:12
    
I agree from a Linux admin perspective that it's not a preferred method. But the guy is asking about a solution for a problem with Security Metrics, and they offer a solution to their own scan findings. It IS a way to stop/disable the service, it satisfies the scanner, so it is a relevant answer. Knocking down my rep on it doesn't change that fact that it does, indeed, work. –  user171212 Apr 26 '13 at 2:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.