I ran netstat on a server I believe is running Linux and found ports 445, 1433, 3306, and 21 open. I'm not sure what services normally use these ports, whether port 445 can be used on Linux, or how to determine which programs opened them. I also tried connecting to 62.238.47.215 with different port numbers but couldn't get anywhere. What commands should I use to identify the listening services, and what should I do if these ports are exposed to the internet? Also, I've been using "poop" as a temporary password because it's easy to type, so let me know if that's a serious problem too.
2 Answers
Port-number lookup sites can tell you the usual assignment, but the local process list is more useful because any service can technically be configured to use a different port. Check the service configuration, firewall rules, and recent logs before assuming compromise. Also change the password immediately: a simple word like “poop” is not safe, particularly for an internet-facing server. And don’t run `sudo rm -rf /` as a joke or troubleshooting step—it can delete the entire filesystem and make the machine unusable.
Those ports usually correspond to common services, and they can run on Linux too: 445 is SMB/Samba file sharing, 1433 is Microsoft SQL Server, 3306 is MySQL or MariaDB, and 21 is FTP. Their presence doesn’t automatically mean someone added them maliciously, but you should confirm which services are installed and whether they actually need to be reachable. Use `sudo ss -tulnp` or `sudo netstat -ntlp` to see the listening processes and their program names. If they’re exposed to the internet, investigate and restrict them with a firewall—especially SMB and database ports.
Thanks, that clears up the port numbers. I’ll check which processes own them and update my notes.