Security CentOS - TCP Port 5001

Discussion in 'Installation/Configuration' started by klausengelmann, Sep 24, 2008.

  1. klausengelmann

    klausengelmann New Member

    Hi !!!

    I recently check a my CentOS 5.2 installation with nmap:

    PORT STATE SERVICE
    22/tcp open ssh
    3306/tcp open mysql
    5001/tcp open commplex-link
    8080/tcp open http-proxy
    8443/tcp open https-alt

    Nmap finished: 1 IP address (1 host up) scanned in 0.080 seconds

    I can't find which process is opening the 5001/tcp.

    Anyone has an ideia about who is opening that port and how to close it ?
    Is there a service that uses this tcp port and is enabled by default after a CentOS Server installation using GUI ???

    Thanks to all,

    Klaus
     
  2. Ben

    Ben ISPConfig Developer ISPConfig Developer

    so netstat -tap does not show any process opening 5001?
    Maybe you got (x)intetd running, that's opening this port...
     
  3. klausengelmann

    klausengelmann New Member

    Ben...

    The services running on that server are:

    [[email protected] ~]# chkconfig --list | grep '3:eek:n'
    anacron 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    apmd 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    atd 0:eek:ff 1:eek:ff 2:eek:ff 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    autofs 0:eek:ff 1:eek:ff 2:eek:ff 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    cpuspeed 0:eek:ff 1:eek:n 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    crond 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    denyhosts 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    gpm 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    haldaemon 0:eek:ff 1:eek:ff 2:eek:ff 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    ip6tables 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    iptables 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    irqbalance 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    kudzu 0:eek:ff 1:eek:ff 2:eek:ff 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    lvm2-monitor 0:eek:ff 1:eek:n 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    messagebus 0:eek:ff 1:eek:ff 2:eek:ff 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    microcode_ctl 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    mysqld 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    network 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    ntpd 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    readahead_early 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    readahead_later 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    sendmail 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    sshd 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    syslog 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    tomcat5 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff
    xfs 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff

    As you can see there is no xinetd ou inetd running.

    Using your suggested command I see the following line:

    tcp 0 0 *:commplex-link *:* LISTEN 10430/java

    Which means that I have to check my Java installation.

    Thanks for the help... I'll see what I can do and I'll post the solution here.
     
  4. falko

    falko Super Moderator ISPConfig Developer

    Is it maybe Tomcat that's using that port?
     

Share This Page