我目前正试图“硬化”我所有的服务器,首先转换所有我不需要的服务。
这是一个nginx反向代理和metasploit说smb 445 tcp过滤http://gyazo.com/6adcdcf4982801f481b8338d913545bb
但我找不到任何服务运行在这个端口上:service –status-all
[ + ] bind9 [ - ] bootlogs [ ? ] bootmisc.sh [ ? ] checkfs.sh [ ? ] checkroot-bootclean.sh [ - ] checkroot.sh [ + ] cron [ + ] fail2ban [ - ] fetchmail [ - ] hostname.sh [ ? ] hwclock.sh [ - ] kbd [ - ] keymap.sh [ ? ] killprocs [ ? ] kmod [ ? ] modules_dep.sh [ - ] motd [ ? ] mountall-bootclean.sh [ ? ] mountall.sh [ ? ] mountdevsubfs.sh [ ? ] mountkernfs.sh [ ? ] mountnfs-bootclean.sh [ ? ] mountnfs.sh [ ? ] mtab.sh [ ? ] networking [ + ] nginx [ ? ] plymouth [ ? ] plymouth-log [ - ] procps [ - ] quota [ - ] quotarpc [ ? ] rc.local [ - ] rmnologin [ - ] rpcbind [ - ] rsync [ + ] rsyslog [ + ] saslauthd [ ? ] screen-cleanup [ + ] sendmail [ ? ] sendsigs [ + ] ssh [ - ] sudo [ - ] udev [ ? ] udev-mtab [ ? ] umountfs [ ? ] umountnfs.sh [ ? ] umountroot [ - ] urandom [ - ] wide-dhcpv6-client [ ? ] xinetd
任何人都可以请指出我在正确的方向。
Samba被完全删除(apt-get purge samba *),所以不知道为什么它仍然会打开端口445。
很确定这是一个非常基本的问题,但是我的研究并没有提出任何问题。
谢谢
netstat -lnp
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 LOCALHOST:53 0.0.0.0:* LISTEN 1586/named tcp 0 0 127.0.0.2:53 0.0.0.0:* LISTEN 1586/named tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1586/named tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1722/sendmail: MTA: tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1586/named tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 8772/nginx tcp 0 0 0.0.0.0:PORT 0.0.0.0:* LISTEN 1763/sshd tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN 1722/sendmail: MTA: tcp6 0 0 :::53 :::* LISTEN 1586/named tcp6 0 0 ::1:953 :::* LISTEN 1586/named tcp6 0 0 :::PORT :::* LISTEN 1763/sshd udp 0 0 LOCALHOST:53 0.0.0.0:* 1586/named udp 0 0 127.0.0.2:53 0.0.0.0:* 1586/named udp 0 0 127.0.0.1:53 0.0.0.0:* 1586/named udp6 0 0 :::53 :::* 1586/named Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node PID/Program name Path unix 2 [ ACC ] STREAM LISTENING 3750021142 1/init @/com/ubuntu/upstart unix 2 [ ACC ] STREAM LISTENING 3750023597 1662/saslauthd /var/run/saslauthd/mux unix 2 [ ACC ] SEQPACKET LISTENING 3750021553 101/udevd /run/udev/control unix 2 [ ACC ] STREAM LISTENING 3820548573 6223/python /var/run/fail2ban/fail2ban.sock unix 2 [ ACC ] STREAM LISTENING 3820548623 6225/gam_server @/tmp/fam-root- unix 2 [ ACC ] STREAM LISTENING 3750023674 1722/sendmail: MTA: /var/run/sendmail/mta/smcontrol
“smb 445 tcp filtered”并不意味着端口445正在监听。从nmap手册页:
过滤。 意味着防火墙,filter或其他networking障碍物正在阻塞端口,因此Nmap无法判断它是打开还是closures