The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.).
One day I decided to do a security check-up and I checked my UFW rules (sudo ufw status
) and I found these rules that I don't remember adding:
49152 ALLOW Anywhere
49152 (v6) ALLOW Anywhere (v6)
Googling for "port 49152", etc does not bring up any useful information. I know that it is a private/dynamic/ephemeral port but I have no idea what the port was used for and why this firewall rule was on my server, and if possible are there any logs that I could check that would tell me what the port was used for and what added the firewall rule?
The process that was using the port seems to have died as running the following commands:
sudo netstat -tupln
sudo netstat -a
sudo lsof -i
show no signs of a process listening on the port.
List of installed packages: https://paste.ubuntu.com/p/c5NqMbk3wV/
- Could I check what was previously using the port?
- Could this be something dangerous?
- How could I find out what added the firewall rule?
- Have I been compromised?