open ports 25/tcp and 110/tcp

open ports 25/tcp and 110/tcp

[David F. Strauch]

Hello All,

I've been working with giptables firewall and have run into a big issue.
Although my script seems to be correct namp is finding ports 25/tcp and
110/tcp open.  To start troubleshooting this problem I've commented
everything out and stripped down the ruleset to just the default DROP
policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still returns 25/tcp and 110/tcp
as open!

Now I'm starting to think that iptables is broken. I've built iptables with
grsecurity-1.9.12 and iptables1.2.8 with a plain vanilla kernel 2.4.22   Is
anyone aware of any issues?

Dave

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Wednesday 03 December 2003 10:46 pm, David F. Strauch wrote:

> Hello All,
>
> I've been working with giptables firewall and have run into a big issue.
> Although my script seems to be correct namp is finding ports 25/tcp and
> 110/tcp open.  To start troubleshooting this problem I've commented
> everything out and stripped down the ruleset to just the default DROP
> policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still returns 25/tcp and
> 110/tcp as open!
>
> Now I'm starting to think that iptables is broken. I've built iptables with
> grsecurity-1.9.12 and iptables1.2.8 with a plain vanilla kernel 2.4.22   Is
> anyone aware of any issues?

Where are you testing from?

Is there any chance (particularly with port 25) that the requests are being 
redirected to some other server, and this is what is being reported as open?

Try doing "telnet xx.xx.xx.xx 25" and see what login banner you get for the 
SMTP service - does this correspond to the machine you're testing, or any 
other machine you know about?

Try the same thing on port 110 and see if that login banner reveals a clue 
either.

Antony.

-- 
The idea that Bill Gates appeared like a knight in shining armour to lead all 
customers out of a mire of technological chaos neatly ignores the fact that 
it was he who, by peddling second-rate technology, led them into it in the 
first place.

 - Douglas Adams in The Guardian, 25th August 1995

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports 25/tcp and 110/tcp

[David F. Strauch]

Antony,

I'm testing with a Win 98 machine with a direct cross-over connection to the
"would be" external interface.

Dave Strauch
----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, December 03, 2003 5:01 PM
Subject: Re: open ports 25/tcp and 110/tcp


> On Wednesday 03 December 2003 10:46 pm, David F. Strauch wrote:
>
> > Hello All,
> >
> > I've been working with giptables firewall and have run into a big issue.
> > Although my script seems to be correct namp is finding ports 25/tcp and
> > 110/tcp open.  To start troubleshooting this problem I've commented
> > everything out and stripped down the ruleset to just the default DROP
> > policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still returns 25/tcp and
> > 110/tcp as open!
> >
> > Now I'm starting to think that iptables is broken. I've built iptables
with
> > grsecurity-1.9.12 and iptables1.2.8 with a plain vanilla kernel 2.4.22
Is
> > anyone aware of any issues?
>
> Where are you testing from?
>
> Is there any chance (particularly with port 25) that the requests are
being
> redirected to some other server, and this is what is being reported as
open?
>
> Try doing "telnet xx.xx.xx.xx 25" and see what login banner you get for
the
> SMTP service - does this correspond to the machine you're testing, or any
> other machine you know about?
>
> Try the same thing on port 110 and see if that login banner reveals a clue
> either.
>
> Antony.
>
> -- 
> The idea that Bill Gates appeared like a knight in shining armour to lead
all
> customers out of a mire of technological chaos neatly ignores the fact
that
> it was he who, by peddling second-rate technology, led them into it in the
> first place.
>
>  - Douglas Adams in The Guardian, 25th August 1995
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Wednesday 03 December 2003 11:15 pm, David F. Strauch wrote:

> Antony,
>
> I'm testing with a Win 98 machine with a direct cross-over connection to
> the "would be" external interface.

Okay.

What do the telnet tests tell you?   Does the welcome banner suggest which 
machine is actually being reported as open?

Antony.

>
> Dave Strauch
> ----- Original Message -----
> From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
> To: <netfilter@lists.netfilter.org>
> Sent: Wednesday, December 03, 2003 5:01 PM
> Subject: Re: open ports 25/tcp and 110/tcp
>
> > On Wednesday 03 December 2003 10:46 pm, David F. Strauch wrote:
> > > Hello All,
> > >
> > > I've been working with giptables firewall and have run into a big
> > > issue. Although my script seems to be correct namp is finding ports
> > > 25/tcp and 110/tcp open.  To start troubleshooting this problem I've
> > > commented everything out and stripped down the ruleset to just the
> > > default DROP policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still returns
> > > 25/tcp and 110/tcp as open!
> > >
> > > Now I'm starting to think that iptables is broken. I've built iptables
>
> with
>
> > > grsecurity-1.9.12 and iptables1.2.8 with a plain vanilla kernel 2.4.22
>
> Is
>
> > > anyone aware of any issues?
> >
> > Where are you testing from?
> >
> > Is there any chance (particularly with port 25) that the requests are
>
> being
>
> > redirected to some other server, and this is what is being reported as
>
> open?
>
> > Try doing "telnet xx.xx.xx.xx 25" and see what login banner you get for
>
> the
>
> > SMTP service - does this correspond to the machine you're testing, or any
> > other machine you know about?
> >
> > Try the same thing on port 110 and see if that login banner reveals a
> > clue either.
> >
> > Antony.
> >
> > --
> > The idea that Bill Gates appeared like a knight in shining armour to lead
>
> all
>
> > customers out of a mire of technological chaos neatly ignores the fact
>
> that
>
> > it was he who, by peddling second-rate technology, led them into it in
> > the first place.
> >
> >  - Douglas Adams in The Guardian, 25th August 1995
> >
> >                                                      Please reply to the
>
> list;
>
> >                                                            please don't
> > CC
>
> me.

-- 
Anything that improbable is effectively impossible.

 - Murray Gell-Mann, Novel Prizewinner in Physics

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports 25/tcp and 110/tcp

[David F. Strauch]

Antony,

I tried telnet from my WinXP machine to both open ports without any
responce.  I'm hosting neither services on this machine.  It will be a
gateway machine with a very minimal hardened installation.

Dave

----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, December 03, 2003 5:01 PM
Subject: Re: open ports 25/tcp and 110/tcp


> On Wednesday 03 December 2003 10:46 pm, David F. Strauch wrote:
>
> > Hello All,
> >
> > I've been working with giptables firewall and have run into a big issue.
> > Although my script seems to be correct namp is finding ports 25/tcp and
> > 110/tcp open.  To start troubleshooting this problem I've commented
> > everything out and stripped down the ruleset to just the default DROP
> > policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still returns 25/tcp and
> > 110/tcp as open!
> >
> > Now I'm starting to think that iptables is broken. I've built iptables
with
> > grsecurity-1.9.12 and iptables1.2.8 with a plain vanilla kernel 2.4.22
Is
> > anyone aware of any issues?
>
> Where are you testing from?
>
> Is there any chance (particularly with port 25) that the requests are
being
> redirected to some other server, and this is what is being reported as
open?
>
> Try doing "telnet xx.xx.xx.xx 25" and see what login banner you get for
the
> SMTP service - does this correspond to the machine you're testing, or any
> other machine you know about?
>
> Try the same thing on port 110 and see if that login banner reveals a clue
> either.
>
> Antony.
>
> -- 
> The idea that Bill Gates appeared like a knight in shining armour to lead
all
> customers out of a mire of technological chaos neatly ignores the fact
that
> it was he who, by peddling second-rate technology, led them into it in the
> first place.
>
>  - Douglas Adams in The Guardian, 25th August 1995
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Wednesday 03 December 2003 11:32 pm, David F. Strauch wrote:

> Antony,
>
> I tried telnet from my WinXP machine to both open ports without any
> responce.  I'm hosting neither services on this machine.  It will be a
> gateway machine with a very minimal hardened installation.

Are you saying that from the same machine you did "nmap -sT -F -P0 -O 
xx.xx.xx.xx" and got a report including "SMTP port 25 open" and "POP3 port 
110 open", and also doing "telnet xx.xx.xx.xx 25" gives no response?

That makes no sense, because nmap -sT means a full TCP connect - the same as 
the telnet command would do.

Please confirm whether I am understanding correctly that you are doing both 
these tests from the same machine to the same address and getting different 
answers?

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports 25/tcp and 110/tcp

[David F. Strauch]

Yes, Antony this is the case.  I have only one WinXP machine that I am
testing with.  I'm testing the external interface eth0 and I have unplugged
eth1 from the hub.

When I nmap -sT -p 25,110 -P0 xx.xx.xx.xx I get the following output form
nmap:

Starting nmap V. 3.00 ( www.insecure.org/nmap )
Interesting ports on  (67.153.34.147):
Port       State       Service
25/tcp     open        smtp
110/tcp    open        pop-3

Nmap run completed -- 1 IP address (1 host up) scanned in 1 second

----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, December 03, 2003 5:39 PM
Subject: Re: open ports 25/tcp and 110/tcp


> On Wednesday 03 December 2003 11:32 pm, David F. Strauch wrote:
>
> > Antony,
> >
> > I tried telnet from my WinXP machine to both open ports without any
> > responce.  I'm hosting neither services on this machine.  It will be a
> > gateway machine with a very minimal hardened installation.
>
> Are you saying that from the same machine you did "nmap -sT -F -P0 -O
> xx.xx.xx.xx" and got a report including "SMTP port 25 open" and "POP3 port
> 110 open", and also doing "telnet xx.xx.xx.xx 25" gives no response?
>
> That makes no sense, because nmap -sT means a full TCP connect - the same
as
> the telnet command would do.
>
> Please confirm whether I am understanding correctly that you are doing
both
> these tests from the same machine to the same address and getting
different
> answers?
>
> Antony.
>
> -- 
> All matter in the Universe can be placed into one of two categories:
>
> 1. Things which need to be fixed.
> 2. Things which need to be fixed once you've had a few minutes to play
with
> them.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>
>

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Wednesday 03 December 2003 11:58 pm, David F. Strauch wrote:

> Yes, Antony this is the case.  I have only one WinXP machine that I am
> testing with.  I'm testing the external interface eth0 and I have unplugged
> eth1 from the hub.
>
> When I nmap -sT -p 25,110 -P0 xx.xx.xx.xx I get the following output form
> nmap:
>
> Starting nmap V. 3.00 ( www.insecure.org/nmap )
> Interesting ports on  (67.153.34.147):
> Port       State       Service
> 25/tcp     open        smtp
> 110/tcp    open        pop-3
>
> Nmap run completed -- 1 IP address (1 host up) scanned in 1 second

Well, that just makes no sense to me.   If nmap -sT reports a port open, then 
a telnet to that port from the same machine as the nmap test was done should 
present a welcome banner (for services which provide one, such as SMTP and 
POP3).

Maybe someone else here has a clue what strangeness is going on?

Antony.

-- 
The first fifty percent of an engineering project takes ninety percent of the 
time, and the remaining fifty percent takes another ninety percent of the 
time.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports 25/tcp and 110/tcp

[Michael Gale]

Hello,

	Maybe because you are running nmap from a windows box ?

Have you tried a windows machine ?

Michael.



On Thu, 4 Dec 2003 00:08:36 +0000
Antony Stone <Antony@Soft-Solutions.co.uk> wrote:

> On Wednesday 03 December 2003 11:58 pm, David F. Strauch wrote:
> 
> > Yes, Antony this is the case.  I have only one WinXP machine that I am
> > testing with.  I'm testing the external interface eth0 and I have unplugged
> > eth1 from the hub.
> >
> > When I nmap -sT -p 25,110 -P0 xx.xx.xx.xx I get the following output form
> > nmap:
> >
> > Starting nmap V. 3.00 ( www.insecure.org/nmap )
> > Interesting ports on  (67.153.34.147):
> > Port       State       Service
> > 25/tcp     open        smtp
> > 110/tcp    open        pop-3
> >
> > Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
> 
> Well, that just makes no sense to me.   If nmap -sT reports a port open, then 
> a telnet to that port from the same machine as the nmap test was done should 
> present a welcome banner (for services which provide one, such as SMTP and 
> POP3).
> 
> Maybe someone else here has a clue what strangeness is going on?
> 
> Antony.
> 
> -- 
> The first fifty percent of an engineering project takes ninety percent of the 
> time, and the remaining fifty percent takes another ninety percent of the 
> time.
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: open ports 25/tcp and 110/tcp

[Jeffrey Laramie]

On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> Hello,
>
> 	Maybe because you are running nmap from a windows box ?
>
> Have you tried a windows machine ?

Yes, and it tasted like chicken.



Seriously, that may be a good point. Make sure there isn't anything running on 
the sending box that might interfere with the test. I've had screwed up nmap 
tests when the sending box filtered certain ports.

Jeff

Re: open ports 25/tcp and 110/tcp

[Michael Gale]

I meant to say have you tried a linux box ?

Michael

On Wed, 3 Dec 2003 19:28:32 -0500
Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com> wrote:

> On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> > Hello,
> >
> > 	Maybe because you are running nmap from a windows box ?
> >
> > Have you tried a windows machine ?
> 
> Yes, and it tasted like chicken.
> 
> 
> 
> Seriously, that may be a good point. Make sure there isn't anything running on 
> the sending box that might interfere with the test. I've had screwed up nmap 
> tests when the sending box filtered certain ports.
> 
> Jeff
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: open ports 25/tcp and 110/tcp

[Jeffrey Laramie]

On Wednesday 03 December 2003 19:37, Michael Gale wrote:
> I meant to say have you tried a linux box ?
>

I know, but I couldn't resist :-)


> Michael
>
> On Wed, 3 Dec 2003 19:28:32 -0500
>
> Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com> wrote:
> > On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> > > Hello,
> > >
> > > 	Maybe because you are running nmap from a windows box ?
> > >
> > > Have you tried a windows machine ?
> >
> > Yes, and it tasted like chicken.
> >
> >
> >
> > Seriously, that may be a good point. Make sure there isn't anything
> > running on the sending box that might interfere with the test. I've had
> > screwed up nmap tests when the sending box filtered certain ports.
> >
> > Jeff

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Thursday 04 December 2003 12:28 am, Jeffrey Laramie wrote:

> On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> > Hello,
> >
> > 	Maybe because you are running nmap from a windows box ?
> >
> > Have you tried a windows machine ?
>
> Yes, and it tasted like chicken.
>
>
>
> Seriously, that may be a good point. Make sure there isn't anything running
> on the sending box that might interfere with the test. I've had screwed up
> nmap tests when the sending box filtered certain ports.

This I can understand, but what puzzles me is that David is saying that from 
the same test machine, doing nmap -sT, and telnet xx.xx.xx.xx 25, are giving 
different results.

nmap -sT does a TCP connect, and telnet does a TCP connect, so how is it 
possible for one to say that the port is open, but the other not to show the 
welcome banner?

Antony.

-- 
In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports 25/tcp and 110/tcp

[Jeffrey Laramie]

On Wednesday 03 December 2003 19:39, Antony Stone wrote:
> On Thursday 04 December 2003 12:28 am, Jeffrey Laramie wrote:
> > On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> > > Hello,
> > >
> > > 	Maybe because you are running nmap from a windows box ?
> > >
> > > Have you tried a windows machine ?
> >
> > Yes, and it tasted like chicken.
> >
> >
> >
> > Seriously, that may be a good point. Make sure there isn't anything
> > running on the sending box that might interfere with the test. I've had
> > screwed up nmap tests when the sending box filtered certain ports.
>
> This I can understand, but what puzzles me is that David is saying that
> from the same test machine, doing nmap -sT, and telnet xx.xx.xx.xx 25, are
> giving different results.
>
> nmap -sT does a TCP connect, and telnet does a TCP connect, so how is it
> possible for one to say that the port is open, but the other not to show
> the welcome banner?
>
> Antony.

I don't know. _shrug_ I'd still like to find out what a packet sniffer sees 
during the nmap test.

Re: open ports 25/tcp and 110/tcp

[David F. Strauch]

Antony,

Well I found the answer to the problem ... It's running nmap from the
windows box.  I have another RHL 9.0 that I'm hardening as well.  I
installed nmap on the machine and used it to scan my gateway.   Wouldn't you
know it, all ports scanned are reported as filtered.  There must either be
something on the windows box interfering with the scan or there is something
wrong with nmap's port to windows.

I guess it's hard test when the tools are broken.

Dave
----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, December 03, 2003 6:39 PM
Subject: Re: open ports 25/tcp and 110/tcp


>
> This I can understand, but what puzzles me is that David is saying that
from
> the same test machine, doing nmap -sT, and telnet xx.xx.xx.xx 25, are
giving
> different results.
>
> nmap -sT does a TCP connect, and telnet does a TCP connect, so how is it >
On Thursday 04 December 2003 12:28 am, Jeffrey Laramie wrote:
>
> > On Wednesday 03 December 2003 19:14, Michael Gale wrote:
> > > Hello,
> > >
> > > Maybe because you are running nmap from a windows box ?
> > >
> > > Have you tried a windows machine ?
> >
> > Yes, and it tasted like chicken.
> >
> >
> >
> > Seriously, that may be a good point. Make sure there isn't anything
running
> > on the sending box that might interfere with the test. I've had screwed
up
> > nmap tests when the sending box filtered certain ports.

> possible for one to say that the port is open, but the other not to show
the
> welcome banner?
>
> Antony.
>
> -- 
> In science, one tries to tell people
> in such a way as to be understood by everyone
> something that no-one ever knew before.
>
> In poetry, it is the exact opposite.
>
>  - Paul Dirac
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>
>

Re: open ports 25/tcp and 110/tcp

[Jeffrey Laramie]

On Wednesday 03 December 2003 18:58, David F. Strauch wrote:
> Yes, Antony this is the case.  I have only one WinXP machine that I am
> testing with.  I'm testing the external interface eth0 and I have unplugged
> eth1 from the hub.
>
> When I nmap -sT -p 25,110 -P0 xx.xx.xx.xx I get the following output form
> nmap:
>
> Starting nmap V. 3.00 ( www.insecure.org/nmap )
> Interesting ports on  (67.153.34.147):
> Port       State       Service
> 25/tcp     open        smtp
> 110/tcp    open        pop-3
>
> Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
>

Why don't you run a packet sniffer on this interface and run the test again. 
That should show what it is nmap is seeing, if anything.

Jeff

RE: open ports 25/tcp and 110/tcp

[Rob Sterenborg]

> Although my script seems to be correct namp is finding ports 25/tcp
> and 110/tcp open.  To start troubleshooting this problem I've
> commented everything out and stripped down the ruleset to just the
> default DROP policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still
> returns 25/tcp and 110/tcp as open!

Did you check the PC from another host ? If you do that, the ports 
will show open even if they are closed.
Check from another host and it should show closed or filtered.


Gr,
Rob

Re: open ports 25/tcp and 110/tcp

[Antony Stone]

On Wednesday 03 December 2003 11:08 pm, Rob Sterenborg wrote:

> > Although my script seems to be correct namp is finding ports 25/tcp
> > and 110/tcp open.  To start troubleshooting this problem I've
> > commented everything out and stripped down the ruleset to just the
> > default DROP policy.  Yet nmap -sT -F -P0 -0 xx.xx.xx.xx still
> > returns 25/tcp and 110/tcp as open!
>
> Did you check the PC from another host ? If you do that, the ports
> will show open even if they are closed.

Why?

> Check from another host and it should show closed or filtered.

I just tried the above command on my laptop, testing itself (which doesn't run 
a POP3 or SMTP service) and neither of them showed up as open.

Antony.

-- 
In Heaven, the police are British, the chefs are Italian, the beer is Belgian, 
the mechanics are German, the lovers are French, the entertainment is 
American, and everything is organised by the Swiss.

In Hell, the police are German, the chefs are British, the beer is American, 
the mechanics are French, the lovers are Swiss, the entertainment is Belgian, 
and everything is organised by the Italians.

                                                     Please reply to the list;
                                                           please don't CC me.