Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Why don't some ports identified by Nexpose security scan appear in netstat

Posted on 2014-07-29
9
Medium Priority
?
420 Views
Last Modified: 2014-08-04
I ran a Nexpose security scan against a VMware linux appliance. (vmware data protection)
ports 443 came back with 3 severe vulnerabilities, and port 22 with one.

I putty'd to the appliance, logged in as root, and ran

netstat -ap

Long list of open ports came back, but not ports 443 and 22
Ran Nexpose again and it still listed ports 443 and 22 vulnerabilities

The 443 vulnerabilities related to TLS/SSL ciphers and certificates, and openssl
port 22 was related to SSH.  Openssl and certificates are installed on the appliance so it appears to be correct.

Why don't these ports 22 and 443 appear in netstat?
0
Comment
Question by:dakota5
  • 7
  • 2
9 Comments
 
LVL 5

Expert Comment

by:Pasha Kravtsov
ID: 40227518
One of the reasons could be your machine has a rootkit on it and they have hooked certain functions so that the malicious users weren't noticed. Try telnet'ing to port 22 or port 443 and see what happens.
and just double check
netstat -ap | grep 443
netstat -ap | grep 22

Open in new window

do you have a sshd service running? or a webserver such as apache?
0
 

Assisted Solution

by:dakota5
dakota5 earned 0 total points
ID: 40228281
I discovered that netstat (at least the version distributed in the VMWare appliance) lists the common ports (443, 22, 80, etc)  only by the service names.

port 443 is only listed as https
port 22 is only listed as ssh.

netstat -apt | grep https
netstat -apt | grep ssh

return the expected ports.
0
 

Author Comment

by:dakota5
ID: 40228286
I've requested that this question be closed as follows:

Accepted answer: 0 points for dakota5's comment #a40228281
Assisted answer: 100 points for Pasha Kravtsov's comment #a40227518

for the following reason:

the expert's solution was not actually correct.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 

Author Comment

by:dakota5
ID: 40228285
Just wanted to soften my comment.  The expert did try, but his comment was not useful in this particular instance.
0
 

Author Comment

by:dakota5
ID: 40228287
just wanted to soften my comment.  the expert did try, but his comment was not useful in this particular instance.
0
 

Author Comment

by:dakota5
ID: 40229960
I've requested that this question be closed as follows:

Accepted answer: 0 points for dakota5's comment #a40228281
Assisted answer: 100 points for Pasha Kravtsov's comment #a40227518

for the following reason:

The experts comment might be useful for other situations, but was not actually the issue in this particular instance.
0
 
LVL 5

Accepted Solution

by:
Pasha Kravtsov earned 2000 total points
ID: 40229383
You can see what is running on those ports by doing this command:
lsof -i :22
lsof -i :443

Open in new window

0
 

Author Comment

by:dakota5
ID: 40229961
The expert's latest contribution is actually the best solution.
0
 

Author Closing Comment

by:dakota5
ID: 40238553
my own contribution was first, and is an easy solution as well.
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
This article will show you step-by-step instructions to build your own NTP CentOS server.  The network diagram shows the best practice to setup the NTP server farm for redundancy.  This article also serves as your NTP server documentation.
Teach the user how to install log collectors and how to configure ESXi 5.5 for remote logging Open console session and mount vCenter Server installer: Install vSphere Core Dump Collector: Install vSphere Syslog Collector: Open vSphere Client: Config…
Advanced tutorial on how to run the esxtop command to capture a batch file in csv format in order to export the file and use it for performance analysis. He demonstrates how to download the file using a vSphere web client (or vSphere client) and exp…
Suggested Courses

783 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question