Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I'm desperately trying to pass a Security Metrics test, I've been trying for a few days, but I 'm always left with the same problem:

NetBIOS available on Linux Service: netbios-ssn Port 139 open on Linux machine

I've been googling to no avail.

I've been trying to close port 139 and 445 with both iptables and fuser -k, but it still reports as open (to Security Metrics at least). I've also tried to uninstall Samba and mess with the config file, there's just no way.

Any idea?!

Not sure what else to try...

Any help appreciated.

share|improve this question
What's the output of sudo netstat -tanp? – growse Feb 7 '12 at 22:21
Is the server you are testing behind a NAT ? Maybe the test is seeing another machine behind that NAT ? Did you try to run nmap on the machine ? What is that saying ? – Tonny Feb 7 '12 at 22:27
check /etc/inetd.conf for netbios-ssn entry (which usually runs nmbd) – yarek Feb 7 '12 at 22:27
@yarek I don't have that file... I have xinetd.conf but I don't see anything that could be related to it. :-) – trapach Feb 8 '12 at 0:28
@Tonny yes, nmap says port is closed using both localhost and the ip address... – trapach Feb 8 '12 at 0:29

Double check the IP/hostname they're scanning. Does it match yours? Do an external scan of your own, with nmap, to see if the port is open:

nmap -p 139 hostname (or IP)

If you still have difficulties, enlist the help of your web host (if you use one). Most web hosts will help you secure your site per the PCI scan vendor's specifications, or at least point in the direction to get it fixed.

share|improve this answer
localhost says: rDNS record for localhost.localdomain PORT STATE SERVICE 139/tcp closed netbios-ssn – trapach Feb 8 '12 at 0:23
same thing using ip address. port is closed, looks like it reports open... – trapach Feb 8 '12 at 0:26
You're scanning locally? Scan from a remote location to the public interface; this is the same interface your PCI scan vendor is scanning. – laebshade Feb 16 '12 at 1:43

If you're trying to achieve PCI-DSS compliance and are stuck on this, then I think you need more help then a few answers here. There are some very good, free online training materials - I would recommend the rute as a good starting point. You should also read and apply the SANS Linux checklist.

I've been trying for a few days

What have you tried?

I've also tried to uninstall Samba

What have you tried?

netbios-ssn Port 139 open on Linux machine

The first thing to check is if it really is netbios. As growse says netstat -natp will show you which program is listening on the port. If it is nmbd, then you need to shutdown the server and make sure it never starts again (i.e. uninstall everything you don't need).

The advice given by user171212 will probably work (it'll stop the service) but it's not the right way to control services. For sysV init files, it would be more correct to stop the service and remove the relevant links from the /etc/rc.d/rc*.d but the correct way to do it is via the chkconfig command. Indeed that "Security Metrics" recommends such an approach makes me think that any advice / service they provide should be treated with extreme prejudice.

share|improve this answer

I got the same problem while ago, my solution was simple, very simple.

sudo service smbd stop

The above command will close the service smbd as well both ports 139 and 445, since it is being used by smbd. Do not try to close ports with iptables, it is a packet filtering only. To close ports you need to close the service using the port.

share|improve this answer

from Security Metric's own page on the subject:

To Permanently disable (RedHat):
1. cd /etc/rc.d/init.d/
2. smb stop
3. mv smb no.smb
(ports 137 & 138 will also be closed)


share|improve this answer
This is not how to stop/disable the service - see answer elsewhere. – symcbean Apr 25 '13 at 20:12
I agree from a Linux admin perspective that it's not a preferred method. But the guy is asking about a solution for a problem with Security Metrics, and they offer a solution to their own scan findings. It IS a way to stop/disable the service, it satisfies the scanner, so it is a relevant answer. Knocking down my rep on it doesn't change that fact that it does, indeed, work. – user171212 Apr 26 '13 at 2:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.