0

This is the nmap scan results on my server (used for email and web serving) from a remote scan. Which all ports are in danger and why?

PORT      STATE    SERVICE
21/tcp    open     ftp
25/tcp    open     smtp
42/tcp    filtered nameserver
53/tcp    open     domain
69/tcp    filtered tftp
80/tcp    open     http
110/tcp   open     pop3
135/tcp   filtered msrpc
137/tcp   filtered netbios-ns
138/tcp   filtered netbios-dgm
139/tcp   filtered netbios-ssn
143/tcp   open     imap
161/tcp   filtered snmp
162/tcp   filtered snmptrap
179/tcp   filtered bgp
443/tcp   open     https
445/tcp   filtered microsoft-ds
465/tcp   open     smtps
587/tcp   open     submission
993/tcp   open     imaps
995/tcp   open     pop3s
1028/tcp  filtered unknown
1080/tcp  filtered socks
1214/tcp  filtered fasttrack
1241/tcp  filtered nessus
2077/tcp  open     unknown
2078/tcp  open     unknown
2082/tcp  open     infowave
2083/tcp  open     radsec
2086/tcp  open     gnunet
2087/tcp  open     eli
2095/tcp  open     nbx-ser
2096/tcp  open     nbx-dir
3127/tcp  filtered unknown
3128/tcp  filtered squid-http
3306/tcp  open     mysql
5554/tcp  filtered sgi-esphttp
6666/tcp  filtered irc
6667/tcp  filtered irc
6668/tcp  filtered irc
6777/tcp  filtered unknown
7007/tcp  filtered afs3-bos
9996/tcp  filtered unknown
22816/tcp open     unknown
51180/tcp filtered unknown
42/udp   open|filtered nameserver
53/udp   open          domain?
69/udp   open|filtered tftp
135/udp  open|filtered msrpc
137/udp  open|filtered netbios-ns
138/udp  open|filtered netbios-dgm
139/udp  open|filtered netbios-ssn
161/udp  open|filtered snmp
|_snmp-hh3c-logins: TIMEOUT
|_snmp-win32-shares: TIMEOUT
162/udp  open|filtered snmptrap
1701/udp open|filtered L2TP
  • 1
    As your question stands now it is too broad, what is the purpose of this server? – KDEx Dec 17 '14 at 5:24
  • Well, are you sure you have so many open ports? This seems like an impossible list. – mincewind Dec 17 '14 at 5:55
  • It is a webpage :) – Anonymous Platypus Dec 17 '14 at 5:56
  • It's actually fairly typical for a server set up by an inexperienced admin. – Mark Dec 17 '14 at 6:21
  • This probably depends on the overall outlook of the organization. – mincewind Dec 17 '14 at 6:25
4

Without knowing anything about your server, I'd classify the following ports as a danger:

53/tcp    open     domain
53/udp   open          domain?

Most people shouldn't be running publicly accessible DNS servers. If it's not locked down properly, your server can be hijacked to participate in a reflected denial-of-service attack.

3306/tcp  open     mysql

You should never expose your database server to the Internet at large.

2077/tcp  open     unknown
2078/tcp  open     unknown
2082/tcp  open     infowave
2083/tcp  open     radsec
2086/tcp  open     gnunet
2087/tcp  open     eli
2095/tcp  open     nbx-ser
2096/tcp  open     nbx-dir

22816/tcp open     unknown

These ports don't correspond to any standard service. Find out what's got them open and firewall it or shut it down.

I'd classify these as potentially problematic:

21/tcp    open     ftp

You shouldn't be using FTP these days. It transfers credentials in the clear, it's a pain to make it work with firewalls, and in general it's an old, crufty protocol. Shut your FTP server down and do any file serving over HTTP, HTTPS, or task-specific protocol.

25/tcp    open     smtp

If your SMTP server isn't configured right, you can find it being used as a spam relay.

The rest of the open ports may or may not be a problem, depending on the purpose of the server.

  • Purpose of my server is to run a single page website which is having a mail server and a database. – Anonymous Platypus Dec 17 '14 at 5:59
4

No matter the purpose you should only have open what is absolutely needed. For a basic web server this should be either port 80 and or 443.

Having a large number of ports/services exposed is what is known as having a large attack surface. This is basically what hackers look for first.

  • This answer starts with a good premise that should clearly stated. What is known and expected traffic? Allow that, then block the rest. The question being asked makes me think that the response to my question isn't known. – baldPrussian Nov 19 '17 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.