0

When I scan my server using nmap $ sudo nmap -sS IP.ADDR.OF.SRVR, I see a line with 25/tcp open smtp. This is despite the fact that I'm not running postfix, exim or any other kind of mail server on the machine.

I have also tried to block port 25, using IP table rules.

$ sudo iptables -A INPUT -p tcp --destination-port 25 -j DROP

But despite running this and verifying that the iptable rule exists with $ sudo iptables -L -n -v running nmap still shows the port as being open.

I have also run $ netstat -tulnp on the server to see what ports are open, and port 25 does not show up in the list there.

Very confused on how to proceed, any help or pointers would be much appreciated.

Output of sudo iptables -nvL - https://pastebin.com/5W9V2rrz

Output of sudo iptables -t nat -nvL - https://pastebin.com/v9ST06uz

Improve this question
11
  • Can you share a little more info on your setup? From where are you scanning with nmap? Is IP.ADDR.OF.SRVR a public IP configured on your server or any kind of load-balancer, firewall with port mapping, etc. and your server is behind it?
    – Daniele Santi
    Sep 13, 2018 at 10:37
  • @MrShunz i'm running nmap from my laptop at home. IP.ADDR.OF.SRVR is a public IP, and there are no firewalls or load-balancers that the server is behind. The only firewalls are the iptables running on the machine
    – arunkumar
    Sep 13, 2018 at 11:04
  • 2
    It could be that something en route to your server is redirecting SMTP traffic, does your ISP allow direct SMTP access towards the internet? What banner is shown if you connect via telnet?
    – wurtel
    Sep 13, 2018 at 11:08
  • @wurtel when i connect with telnet IP.ADDR.OF.SRVR 25 i see the following Trying IP.ADDR.OF.SRVR \n Connected to mydomain.com \n Escape character is '^]'. Are you talking about my ISP that i'm connecting to the internet from home, or the hosting service that is hosting the machine? As far as I know my ISP does allow direct access to SMTP, because i'm able to telnet to my server on port 25.
    – arunkumar
    Sep 13, 2018 at 11:20
  • Sniff the traffic on your server for port 25, if you set your iptables rule correctly, I bet nothing will be there. Then for example check the hops via traceroute and try every hop for port 25 from 'top' to 'bottom'.
    – Lenniey
    Sep 13, 2018 at 11:23

1 Answer 1

Reset to default
2

It may be the the ordering of your rule is incorrect. Try and move the rule further up, also what version of Linux are you running? If in Ubuntu try #> lsof -i -n -P | grep :25 and see what program is being used to listen on that port and then change/stop that process

Improve this answer
6
  • the output of the lsof command is blank, which is the same as the the output of netstat, showing nothing running on port 25.
    – arunkumar
    Sep 13, 2018 at 11:06
  • 1
    Try sudo fuser 25/tcp
    – wurtel
    Sep 13, 2018 at 11:07
  • @wurtel i got a number of lines with this - Cannot stat file /proc/9999/fd/9: Stale file handle but nothing else.
    – arunkumar
    Sep 13, 2018 at 11:14
  • @arunkumar OK, so nothing is actually listening to port 25. Although if you have virtual machines or containers (docker, lxc) those may be listening indirectly (iptables nat rules)...
    – wurtel
    Sep 13, 2018 at 19:21
  • 1
    @wurtel i'm running docker, there was one container which provided postfix-relay services, but it wasn't exposed to the host port. (Only provided SMTP to other containers). I tried turning that docker container off as well, but I'm still able to telnet to port 25 on the server
    – arunkumar
    Sep 14, 2018 at 3:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .