Securing Your Server: Finding Active Network Ports

A critical part of securing a server is closing ports that are not in use, or that correspond with services that are not necessary for your normal server operations.

To see a list of ports that are actively listening on your server, open an SSH session and use netstat :

netstat -plan

You may see output similar to the following:

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 59289/exim

tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 9596/pure-ftpd (SER

tcp 0 0 173.205.126.10:53 0.0.0.0:* LISTEN 52371/named

…

…

From the truncated sample output above, you can see that Exim, Pure-FTP, and Named are listening on ports 465, 21, and 53, respectively. The actual output will be a lot longer, and will reflect all services that are actively listening on TCP or UDP ports.

The next step is to disable any services that you don’t need running. For example, if you see that Named is running but your server is not acting as a nameserver, there’s no need for that service to be active. You can disable most common services in WHM > Service Manager.

Now, especially if you have just installed a new firewall, you should do an external Nmap test to verify that all ports that should be closed actually are. The easiest way to run an Nmap test is by going to http://hackertarget.com/nmap-scan/ and launch a free nmap test:

The test results will be emailed to you within moments, showing you what ports were detected as being open.

If you have a firewall on your server (which hopefully you do), the next step is to check the list of TCP and UDP ports that are allowed and compare them with what services are running. Go through the list of open TCP and UDP ports in your firewall’s allow list and compare it with the new output of netstat. Any ports that are open that do not correspond with running services (or services that should be publicly accessible) should be closed.

Remember – having more avenues to your server makes it easier for hackers to find a way in. Detecting and closing unnecessary ports is a very simple way to help harden your server.