Managing open ports in Linux is crucial for system security. Open ports can be entry points for unauthorized access if not monitored properly.

This guide will walk you through finding open ports on your Linux system and how to close them to enhance your system’s security.

What Are Open Ports in Linux?

An open port is a network port that accepts incoming connections. Ports are communication endpoints for networked devices, allowing services and applications to communicate over a network. There are two main types:

  • TCP Ports: Ensure reliable communication with error checking.
  • UDP Ports: Faster communication without error checking.

Each service or application running on your Linux system may listen on a specific port for incoming connections.

How to Find Open Ports in Linux

There are several tools available to identify open ports on your Linux system:

  • netstat: Network statistics tool.
  • ss: Socket statistics, a modern replacement for netstat.
  • lsof: Lists open files and ports.
  • nmap: Network scanner for discovering hosts and services.

1. Using netstat to List Open Ports

The netstat command displays network connections, routing tables, and interface statistics.

netstat -tuln

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
udp        0      0 0.0.0.0:68              0.0.0.0:*

This output shows SSH (port 22) and HTTP (port 80) are open and listening for connections.

Explanation:

  • -t: Shows TCP connections.
  • -u: Shows UDP connections.
  • -l: Lists listening ports.
  • -n: Displays addresses and port numbers in numerical form.

2. Using ss to Check Open Ports

The ss command provides similar functionality to netstat but is faster and more efficient.

ss -tuln

Output:

Netid  State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port 
udp    UNCONN     0      0         0.0.0.0:68               0.0.0.0:*         
tcp    LISTEN     0      128       0.0.0.0:22               0.0.0.0:*         
tcp    LISTEN     0      128       [::]:80                  [::]:*

The output shows open ports similar to Netstat.

3. Using lsof to Find Listening Ports

The lsof command lists open files, which can include network connections since they are treated as files in Unix-like systems.

lsof -i -P -n | grep LISTEN

Output:

sshd      1234    root    3u  IPv4  1234567      0t0  TCP *:22 (LISTEN)
apache2   5678    www-data 3u  IPv6  7654321      0t0  TCP *:80 (LISTEN)

This output shows that sshd is listening on port 22 and apache2 is listening on port 80.

Options Explained:

  • -i: Lists IP-related files.
  • -P: Shows port numbers instead of service names.
  • -n: Avoids DNS lookup for hostnames.

4. Scanning Open Ports with nmap

nmap is a powerful network scanning tool that can discover hosts and services on a network.

Run the following command to scan localhost.

nmap -sT localhost

Output:

Starting Nmap 7.60 ( https://nmap.org ) at 2023-10-01 12:00 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000012s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

This output shows that ports 22 and 80 are open on the localhost.

How to Close Open Ports in Linux

To close an open port, you generally need to stop the service using it.

The basic syntax to stop the service is shown below:

systemctl stop service-name

For example, if you want to close HTTP port 80, you will need to stop the Apache service.

systemctl stop apache2

To stop SSH port 22, run the following command:

systemctl stop sshd

Blocking Ports Using Firewall (iptables or UFW)

You can use firewall rules if you cannot stop a service but want to block access to a port.

Using iptables to Block a Port

iptables -A INPUT -p tcp --dport 80 -j DROP

Verify the added rules.

iptables -L

Output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             tcp dpt:80

Using UFW to Block a Port

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables.

To close/block the port 80, run:

ufw deny 80/tcp

Verify UFW Status:

ufw status

Output:

Status: active

To                         Action      From
--                         ------      ----
80/tcp                     DENY        Anywhere
80/tcp (v6)                DENY        Anywhere (v6)

Conclusion

Monitoring and managing open ports is a fundamental aspect of Linux system security. Regularly checking for open ports and closing or securing them reduces potential vulnerabilities. You can now easily find open ports and close them on dedicated server hosting from Atlantic.Net!