0

When I scan my server using nmap $ sudo nmap -sS IP.ADDR.OF.SRVR, I see a line with 25/tcp open smtp. This is despite the fact that I'm not running postfix, exim or any other kind of mail server on the machine.

I have also tried to block port 25, using IP table rules.

$ sudo iptables -A INPUT -p tcp --destination-port 25 -j DROP

But despite running this and verifying that the iptable rule exists with $ sudo iptables -L -n -v running nmap still shows the port as being open.

I have also run $ netstat -tulnp on the server to see what ports are open, and port 25 does not show up in the list there.

Very confused on how to proceed, any help or pointers would be much appreciated.

Output of sudo iptables -nvL - https://pastebin.com/5W9V2rrz

Output of sudo iptables -t nat -nvL - https://pastebin.com/v9ST06uz

  • Can you share a little more info on your setup? From where are you scanning with nmap? Is IP.ADDR.OF.SRVR a public IP configured on your server or any kind of load-balancer, firewall with port mapping, etc. and your server is behind it? – Mr Shunz Sep 13 '18 at 10:37
  • @MrShunz i'm running nmap from my laptop at home. IP.ADDR.OF.SRVR is a public IP, and there are no firewalls or load-balancers that the server is behind. The only firewalls are the iptables running on the machine – arunkumar Sep 13 '18 at 11:04
  • 2
    It could be that something en route to your server is redirecting SMTP traffic, does your ISP allow direct SMTP access towards the internet? What banner is shown if you connect via telnet? – wurtel Sep 13 '18 at 11:08
  • @wurtel when i connect with telnet IP.ADDR.OF.SRVR 25 i see the following Trying IP.ADDR.OF.SRVR \n Connected to mydomain.com \n Escape character is '^]'. Are you talking about my ISP that i'm connecting to the internet from home, or the hosting service that is hosting the machine? As far as I know my ISP does allow direct access to SMTP, because i'm able to telnet to my server on port 25. – arunkumar Sep 13 '18 at 11:20
  • Sniff the traffic on your server for port 25, if you set your iptables rule correctly, I bet nothing will be there. Then for example check the hops via traceroute and try every hop for port 25 from 'top' to 'bottom'. – Lenniey Sep 13 '18 at 11:23
2

It may be the the ordering of your rule is incorrect. Try and move the rule further up, also what version of Linux are you running? If in Ubuntu try #> lsof -i -n -P | grep :25 and see what program is being used to listen on that port and then change/stop that process

  • the output of the lsof command is blank, which is the same as the the output of netstat, showing nothing running on port 25. – arunkumar Sep 13 '18 at 11:06
  • Try sudo fuser 25/tcp – wurtel Sep 13 '18 at 11:07
  • @wurtel i got a number of lines with this - Cannot stat file /proc/9999/fd/9: Stale file handle but nothing else. – arunkumar Sep 13 '18 at 11:14
  • @arunkumar OK, so nothing is actually listening to port 25. Although if you have virtual machines or containers (docker, lxc) those may be listening indirectly (iptables nat rules)... – wurtel Sep 13 '18 at 19:21
  • 1
    @wurtel i'm running docker, there was one container which provided postfix-relay services, but it wasn't exposed to the host port. (Only provided SMTP to other containers). I tried turning that docker container off as well, but I'm still able to telnet to port 25 on the server – arunkumar Sep 14 '18 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.