Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security.

PORT      STATE    SERVICE      VERSION
21/tcp    open     ftp          ProFTPD
23/tcp    filtered telnet
25/tcp    open     smtp         Exim smtpd
80/tcp    open     http         nginx
110/tcp   open     pop3         Dovecot pop3d
135/tcp   filtered msrpc
143/tcp   open     imap         Dovecot imapd
161/tcp   filtered snmp
443/tcp   open     ssl/http     nginx
445/tcp   filtered microsoft-ds
465/tcp   open     ssl/smtp     Exim smtpd 4.X
587/tcp   open     smtp         Exim
993/tcp   open     ssl/imap     Dovecot imapd
995/tcp   open     ssl/pop3     Dovecot pop3d
1433/tcp  filtered ms-sql-s
1434/tcp  filtered ms-sql-m
2222/tcp  open     sftp         ProFTPD mod_sftp 0.9.7
3306/tcp  filtered mysql
3333/tcp  filtered dec-notes
4899/tcp  filtered radmin
5800/tcp  filtered vnc-http
5801/tcp  filtered vnc-http-1
5900/tcp  filtered vnc
5901/tcp  filtered vnc-1
20000/tcp filtered dnp

First thing I noticed is that it's running an outdated version of ProFTPD. Will this or anything else have any security impact on my server ?

share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

21/tcp - In general you should not have this port open. You should switch to a secure FTP. If you must keep it open at least limit access to only those IP addresses that update content.

23/tcp - Telnet should no longer be used. Switch to SSH.

25/tcp - This means an email service could be running on this server. If you are not running email, this port should not be open.

110/tcp - This is for receiving email. If no email server is present, this port should not be open. BTW, if you are running email, it really should be on a different server. If you are short on hardware, you might consider VMware and create two VMs - one for web and one for email. Email access to should be limited to those using a VPN with authentication.

Also the database ports for MSSql and MySQL are open, this is a very dangerous configuration. It implies that people from the outside can reach databases directly. If there are databases on this server, they should be moved to servers behind another firewall.

I am not familiar with the other open ports. But, in general, they should not be accessible from the Internet except via VPN.

You either need to close the risky ports or add some firewall/VPN protection to at least minimize who can access those ports.

share|improve this answer
add comment

A Brief Note On Banner Grabbing

The first, biggest, hurdle one faces when getting into vulnerability assessments or penetration testing is understanding the limitations of whatever detection mechanism you're using. Like Rory said, you didn't really say how you got the presented list of ports, however it looks like an NMAP scan using banner grabbing. This Is Important! Banner grabbing works by asking each scanned port,

"Hello old chap! Anything you might be able to assist me with?"

The results rely on both being able to access the port, and the service responding accurately.

Issues With Banner Grabbing

You will often find that distributions that attempt to provide long term support, RedHat being the classic example, that these banners are not necessarily useful. Typically, when a bug is found in a piece of software (and assuming it is fixed) then a new version will be released that fixes the issue. Often, these long term support distributions do not want to blindly upgrade the software. So, in order to address bugs, the vendor will manually apply the patch to the older version. This is often called "backporting". As a result, the patch gets applied, but the banner still says the old version.

Better Options

While a quick nmap scan with banner grabbing can be useful, it is only a first step that may be useful in identifying low hanging fruit. To really good good information on your system there are a few other things you can do.

  1. Ask - The easiest answer here is to ask your friend for the system configuration information. What distribution is it running, what binaries are listening on each port, what versions of software are installed, what is his patching schedule, when was it last patched, etc. This is all, of course, limited to what he actually tells you, but so long as he is trustworthy and competent, it will result in better information.
  2. Credentialed Scans - This is my personal favorite. The better vulnerability assessment products will, given adequate credentials and a way to log into the system, can perform a laundry list of local checks. This is how one can bypass the backported fixed issue discussed above. Some, such as Tenable's Nessus are free for use in certain situations and are nearly as full featured as their commercial versions.
  3. Exploit It! - Assuming you have permission, you can always try exploiting the service. If you succeed, then you know there's a problem. This can also give you a chance to really start trying out some fun things like finding and using known exploits, or getting to know a framework like Metasploit.
share|improve this answer
add comment

Some general recommendations:

I couldn't tell from the question what level of scanning you were using. Ensure you grab all info on service versions, confirm these are correct, find latest patches/versions from supplier and upgrade.

Also, do you need sql traffic through your firewall? If not, kill it!

And a minor one - you have ftp and sftp running. If possible you should just shutdown ftp entirely as it is inherently insecure.

share|improve this answer
add comment

old ProFTPD could lead to problems (it can be an attack vector), considering that Debian old-stable (lenny) has ProFTPD version 1.3.1 I'd say that either:

  • He's running very old distribution, most likely already unsupported,
  • It's version number of mod_ssl in ProFTPD, not ProFTPD

nmap performs real version detection when the -A switch is added, not by default

Lack of version numbers for exim, nginx and dovecot would rather suggest the second possibility.

Just ask him, which distribution is he using, when was the last time he performed an update.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.