Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm setting up a new debian server and I don't need FTP so I want to remove it. According to netstat -tap, ftp isn't listening on anything. However when I do a port scan (nmap) externally it says the ftp port is open (21). inetd isn't starting anything, xinetd isn't on the system.

What should I do?

result of netstat tap

obu1:/etc/pam.d# netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:225                   *:*                     LISTEN     2237/sbadm
tcp6       0      0 *:ssh                   *:*                     LISTEN     2399/sshd
tcp6       0    448 obu1.hostname.:ssh rrcs-XXX-XXX-XXX-XXX:56721 ESTABLISHED  16639/sshd: username
NMap from non-local
Starting Nmap 4.90RC1 ( http://nmap.org ) at 2009-07-13 10:47 Eastern Daylight Time
Interesting ports on obu1.hostname (ipaddress):
Not shown: 972 closed ports, 26 filtered ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 3.60 seconds
share|improve this question
1  
You should include the full output from netstat and nmap commands (disguising any public IP addresses and host names if ther are any in the output). If nmap sees the port as open then there should be something listening, unless the port is being redirected by iptables rules on the machine or forward/redirect rules on a device between you and it. –  David Spillett Jul 13 '09 at 14:49
1  
Telnet to the IP using port 21 and see what response you get. Still, post the output of your netstat. –  Dave Forgac Jul 13 '09 at 15:04
    
When I telnet to it, I get a line break and then Press any key to continue... which returns me to the telnet prompt –  Malfist Jul 13 '09 at 15:08
    
True, you don't need FTP, expecially since the SSH daemon has its own FTP module for accomplishing SFTP through a tunnel. –  djangofan Apr 26 '10 at 22:43

8 Answers 8

up vote 3 down vote accepted

You should know that Windows XP (and probably other versions) has an internal wrapper for FTP connections (the purpose of this is to try to allow PORT command to complete successfully, even behind a firewall or a router).

This wrapper intercepts any connection to any host on port 21, so it can monitor it and try to open the incoming port of a PORT command issued by the client.

This wrapper also has a side effect: as it intercepts any connection to a port 21, it sends a signal that the connection has been established to the software, which will see the connection as established, but the connection is really established only to Windows's internal wrapper.

The wrapper then tries to open the connection to the real host, and if it timeouts, then it sends a signal to the software that the connection has been lost. The software will see the connection as lost.

Summing this up, the software believes a connection has been successfully established, then lost, but no real connection has been established.

So, in your case, what happens: you run nmap. Nmap tries to connect to your server on port 21. Windows's wrapper intercepts the connection. Nmap "thinks" it is connected to your server (but it's only connected to the wrapper), and reports the port as opened.

You can confirm this by typing in a command line:

ftp 4.3.2.1

You'll see: C:>ftp 4.3.2.1

Connected to 4.3.2.1.

Connection closed by foreign host.

You can try any valid IP, ftp will always connect, and disconnect shortly after, whereas it should report "Connection timed out".

I never saw any documentation about this. After many investigation, I discovered this strange behavior, and after more investigation, discovered why it is here.

Well, the conclusion of this (big) answer is that the port 21 of your server is definitely closed, as netstat reports, and nmap is fooled by this behaviour.

share|improve this answer
1  
I'm running a debian server, not a windows server. –  Malfist Jul 13 '09 at 16:03
    
But you must be running nmap from a windows machine, and that's what counts here. If you're running nmap from a non-windows machine, you can still try to confirm this behaviour with the command I provided. –  FWH Jul 13 '09 at 16:05

apt-get remove --purge ftp

Replace ftp with whatever the package is called. I am not sure exactly what it is, but to my knowledge that command should work.

apt-get clean

This will clean up your var directory after an uninstall.

share|improve this answer
    
I just did that, but the port scan still shows port 21 is open. –  Malfist Jul 13 '09 at 14:44

Use one of the below commands to find out what program is actually listening on port 21.

netstat -lp

lsof -i :21

This should help you find out what specific package needs to be removed or reconfigured.

share|improve this answer
    
Neither of those list anything listening on port 21. –  Malfist Jul 13 '09 at 14:48

Depending on what inetd and configuration style you're running, look for an ftp service definition in /etc/inetd.conf, /etc/xinetd.d and/or /etc/xinetd.conf. If found, destroy.

share|improve this answer
    
There isn't one. inetd isn't launching anything, and xinetd isn't on the system. –  Malfist Jul 13 '09 at 15:07

Are you sure you're scanning the right IP? netstat shows port 225 and 22, nmap shows 21 and 22...either you're scanning the wrong IP, there's a firewall inbetween that's doing stuff, or maybe some iptables rules on your server re-routing packets. I would say check 'iptables -L -n' to make sure there's nothing related to FTP in there.

share|improve this answer

Is the external nmap you're doing to the IP address of the server? Maybe is passing through a firewall or router. What happens when you do a nmap from localhost?

share|improve this answer
1  
It's a port scan of the server's ipaddress. nmap from localhost doesn't show port 21 open. –  Malfist Jul 13 '09 at 15:28
    
Hummm. maybe something is wrong with the equipment from you're doing the nmap. Have you tried to do the test from other equipment? –  HD. Jul 13 '09 at 15:35
    
If you shut down the server and nmap the IP, is 21 still open? –  ThatGraemeGuy Jul 13 '09 at 16:00
  1. Check firewall rules on host

  2. Try nmap from different hosts do they all see port 21 open.

  3. Make sure you are running all commands as root.

  4. Use a cross cable to connect to your server. Switch of firewall on both server and machine you connected to server using cross-cable and do nmap again.

  5. Telnet from some host to port 21. Do not press key when message "Press any key to continue.." comes. Then as root try these commands

    netstat -lp lsof -i :21

  6. If still no luck. Stop firewall. Start some newservice on host (say httpd) and again do port scan from different locations. Can you see additional http port open.

If localhost cant see process listening on port 21 then there is something between the host from where you are doing nmap and the server. That is why point 4 is about connecting host with nmap and server directly.

share|improve this answer
    
I don't have physical access to the server –  Malfist Jul 13 '09 at 16:03

You should definitely check that your router is NOT forwarding any 21 port to your server, even you are not running any FTP services, NMAP will list ports as open if the router is doing its forwarding job.

share|improve this answer
    
you were saying that when u scan localhost, doesn't show up port 21, sounds like I said, router forwarding. I've seen something very similar. –  Mike Jul 14 '09 at 4:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.