up vote 1 down vote favorite
share [g+] share [fb]

all.

I'm desperately trying to pass a Security Metrics test, I've been trying for a few days, but I 'm always left with the same problem:

NetBIOS available on Linux Service: netbios-ssn Port 139 open on Linux machine

I've been googling to no avail.

I've been trying to close port 139 and 445 with both iptables and fuser -k, but it still reports as open (to Security Metrics at least). I've also tried to uninstall Samba and mess with the config file, there's just no way.

Any idea?!

Not sure what else to try...

Any help appreciated.

link|improve this question
1  
What's the output of sudo netstat -tanp? – growse Feb 7 at 22:21
Is the server you are testing behind a NAT ? Maybe the test is seeing another machine behind that NAT ? Did you try to run nmap on the machine ? What is that saying ? – Tonny Feb 7 at 22:27
check /etc/inetd.conf for netbios-ssn entry (which usually runs nmbd) – yarek Feb 7 at 22:27
@yarek I don't have that file... I have xinetd.conf but I don't see anything that could be related to it. :-) – trapach Feb 8 at 0:28
@Tonny yes, nmap says port is closed using both localhost and the ip address... – trapach Feb 8 at 0:29
show 2 more comments
feedback

1 Answer

up vote 0 down vote

Double check the IP/hostname they're scanning. Does it match yours? Do an external scan of your own, with nmap, to see if the port is open:

nmap -p 139 hostname (or IP)

If you still have difficulties, enlist the help of your web host (if you use one). Most web hosts will help you secure your site per the PCI scan vendor's specifications, or at least point in the direction to get it fixed.

link|improve this answer
localhost says: rDNS record for 127.0.0.1: localhost.localdomain PORT STATE SERVICE 139/tcp closed netbios-ssn – trapach Feb 8 at 0:23
same thing using ip address. port is closed, looks like it reports open... – trapach Feb 8 at 0:26
You're scanning locally? Scan from a remote location to the public interface; this is the same interface your PCI scan vendor is scanning. – laebshade Feb 16 at 1:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.