Solved

Why don't some ports identified by Nexpose security scan appear in netstat

Posted on 2014-07-29
9
389 Views
Last Modified: 2014-08-04
I ran a Nexpose security scan against a VMware linux appliance. (vmware data protection)
ports 443 came back with 3 severe vulnerabilities, and port 22 with one.

I putty'd to the appliance, logged in as root, and ran

netstat -ap

Long list of open ports came back, but not ports 443 and 22
Ran Nexpose again and it still listed ports 443 and 22 vulnerabilities

The 443 vulnerabilities related to TLS/SSL ciphers and certificates, and openssl
port 22 was related to SSH.  Openssl and certificates are installed on the appliance so it appears to be correct.

Why don't these ports 22 and 443 appear in netstat?
0
Comment
Question by:dakota5
  • 7
  • 2
9 Comments
 
LVL 5

Expert Comment

by:Pasha Kravtsov
ID: 40227518
One of the reasons could be your machine has a rootkit on it and they have hooked certain functions so that the malicious users weren't noticed. Try telnet'ing to port 22 or port 443 and see what happens.
and just double check
netstat -ap | grep 443
netstat -ap | grep 22

Open in new window

do you have a sshd service running? or a webserver such as apache?
0
 

Assisted Solution

by:dakota5
dakota5 earned 0 total points
ID: 40228281
I discovered that netstat (at least the version distributed in the VMWare appliance) lists the common ports (443, 22, 80, etc)  only by the service names.

port 443 is only listed as https
port 22 is only listed as ssh.

netstat -apt | grep https
netstat -apt | grep ssh

return the expected ports.
0
 

Author Comment

by:dakota5
ID: 40228286
I've requested that this question be closed as follows:

Accepted answer: 0 points for dakota5's comment #a40228281
Assisted answer: 100 points for Pasha Kravtsov's comment #a40227518

for the following reason:

the expert's solution was not actually correct.
0
 

Author Comment

by:dakota5
ID: 40228285
Just wanted to soften my comment.  The expert did try, but his comment was not useful in this particular instance.
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:dakota5
ID: 40228287
just wanted to soften my comment.  the expert did try, but his comment was not useful in this particular instance.
0
 

Author Comment

by:dakota5
ID: 40229960
I've requested that this question be closed as follows:

Accepted answer: 0 points for dakota5's comment #a40228281
Assisted answer: 100 points for Pasha Kravtsov's comment #a40227518

for the following reason:

The experts comment might be useful for other situations, but was not actually the issue in this particular instance.
0
 
LVL 5

Accepted Solution

by:
Pasha Kravtsov earned 500 total points
ID: 40229383
You can see what is running on those ports by doing this command:
lsof -i :22
lsof -i :443

Open in new window

0
 

Author Comment

by:dakota5
ID: 40229961
The expert's latest contribution is actually the best solution.
0
 

Author Closing Comment

by:dakota5
ID: 40238553
my own contribution was first, and is an easy solution as well.
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ESX Server build 12 56
ESXi 6 ESXTOP %C0 and %C1 Stats 8 38
how to rebuild XFS volume from LV 19 27
vmware application discovery and mapping 2 4
This is an issue that we can get adding / removing permissions in the vCSA 6.0. We can also have issues searching for users / groups in the AD (using your identify sources). This is how one of the ways to handle this issues and fix it.
This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
Teach the user how to convert virtaul disk file formats and how to rename virtual machine files on datastores. Open vSphere Web Client: Review VM disk settings: Migrate VM to new datastore with a thick provisioned (lazy zeroed) disk format: Rename a…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now