1

The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.).

One day I decided to do a security check-up and I checked my UFW rules (sudo ufw status) and I found these rules that I don't remember adding:

49152                      ALLOW       Anywhere
49152 (v6)                 ALLOW       Anywhere (v6)

Googling for "port 49152", etc does not bring up any useful information. I know that it is a private/dynamic/ephemeral port but I have no idea what the port was used for and why this firewall rule was on my server, and if possible are there any logs that I could check that would tell me what the port was used for and what added the firewall rule?

The process that was using the port seems to have died as running the following commands:

sudo netstat -tupln
sudo netstat -a
sudo lsof -i

show no signs of a process listening on the port.

List of installed packages: https://paste.ubuntu.com/p/c5NqMbk3wV/

  • Could I check what was previously using the port?
  • Could this be something dangerous?
  • How could I find out what added the firewall rule?
  • Have I been compromised?
Improve this question
10
  • Perhaps this may be informative: Speed Guide Port 49152
    – user10216038
    Dec 21, 2020 at 16:36
  • 1
    It is unknown what you did to your system and your environment, i.e. there is a significant lack of information to answer your question. One can only speculate, which does not provide good answers. But for example Mediatomb media server uses this port by default. Unless there are more indicators of a compromise I would suggest that the system is not compromised but that you simply "did something" which caused this rule to be generated.
    – Steffen Ullrich
    Dec 21, 2020 at 16:41
  • @SteffenUllrich what sort of information would someone require? I have added a list of installed packages if that would help.
    – AMDBartek
    Dec 21, 2020 at 16:51
  • An important information would be that you have a history of what you did on the system in terms of installing and removing software, explicit changes to the firewall etc between the time the rule was not there and the time you've found the rule. One of these things you did might be related to the creation of this rule.
    – Steffen Ullrich
    Dec 21, 2020 at 17:03
  • @SteffenUllrich Is there a log for UFW rule modifications?
    – AMDBartek
    Dec 21, 2020 at 17:06

2 Answers 2

Reset to default
1

Any open port can only be dangerous if there is some process listening to it. You say there is no process listening to it. So I would say there is not much risk.

See RFC 6335. All ports are split into several regions that have different purposes. To 49152:

Ports in the Dynamic Ports range (49152-65535) have been specifically set aside for local and dynamic use and cannot be assigned through IANA. Application software may simply use any dynamic port that is available on the local host, without any sort of assignment.

Some of applications has used it. Which one, it is impossible to say.

Should you worry? I don't see reason to expect high risk.

If you are curious what might have cause it, I'd suggest to look at syslog. There might be entries where this port is referenced.

Improve this answer
4
  • I am not that worried about the application, I am more concerned about the firewall rule that was automatically made, what could be a plausible explanation for the firewall rule that got automatically created? Looking through syslog searching for "49152" didn't yield anything.
    – AMDBartek
    Dec 21, 2020 at 17:25
  • When installing some software package you used root permissions. These permissions were sufficient to modify firewall rules. The install script has probably contained an instruction to add this firewall rule. If this is true, then such assignment was not quite correct, because the ports in the range 49152 - 65535 cannot be officially assigned to any application and thus it is impossible to make sure that this particular port will be free at particular moment of time.
    – mentallurg
    Dec 21, 2020 at 17:30
  • Is there any way I could check what package it was?
    – AMDBartek
    Dec 21, 2020 at 17:32
  • No way to know it for sure. As I said, check syslog. If the port was really used, there might be an entry about this.
    – mentallurg
    Dec 21, 2020 at 19:31
1

Modern operating systems are extremely complex. Finding something you can't explain is not a reason to assume hackers did it. There's almost certainly hundreds, if not thousands of things going on inside a modern computer that aren't immediately obvious why they're there. The far more likely scenario is that some piece of software opened that firewall port.

Finding out WHAT caused this isn't going to be easy. You could start with looking for the file that contains that config, and seeing when it was last modified. Then looking at other logs to see if some other piece of software was installed around that time. Then see if that piece of software might have caused the firewall rule.

Improve this answer
2
  • What sorts of logs should I be looking for and where would such logs be located?
    – AMDBartek
    Dec 24, 2020 at 22:08
  • @AMDBartek Unfortunately I'm not an expert on all the various logs files on Ubuntu. You might ask over on server fault, but start looking at the various logs in /var/log. I will warn you that it's not easy looking at log files when you don't really know what you're looking for. This question also might be better asked over their, since they might be more familiar with what might legitimately cause what you're seeing.
    – Steve Sether
    Dec 25, 2020 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .