I am running these commands to get a list of all open ports on my Ubuntu 16 server. I was wondering why ports 1-25 appear to be open? Is this a security risk or is this normal for an Ubuntu server?
I have specifically changed the port for ssh to 33333. Using 80/443 for public access to a site. Other than that, I haven't made any other changes myself.
UFW is on and shows as expected:
Nginx Full ALLOW Anywhere
33333/tcp ALLOW Anywhere
Nginx Full (v6) ALLOW Anywhere (v6)
33333/tcp (v6) ALLOW Anywhere (v6)
username@myserver:~$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1527/mysqld
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 4707/nginx -g daemo
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2018/master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 4707/nginx -g daemo
tcp 0 0 0.0.0.0:33333 0.0.0.0:* LISTEN 1477/sshd
tcp6 0 0 :::80 :::* LISTEN 4707/nginx -g daemo
tcp6 0 0 ::1:25 :::* LISTEN 2018/master
tcp6 0 0 :::443 :::* LISTEN 4707/nginx -g daemo
tcp6 0 0 :::33333 :::* LISTEN 1477/sshd
udp 0 0 10.19.0.5:123 0.0.0.0:* 1649/ntpd
udp 0 0 xxx.xxx.xxx.xxx:123 0.0.0.0:* 1649/ntpd
udp 0 0 127.0.0.1:123 0.0.0.0:* 1649/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:* 1649/ntpd
udp6 0 0 zzzz::zzzz:zzzz:zzz:123 :::* 1649/ntpd
udp6 0 0 yyyy::yyyy:yyyy:yyy:123 :::* 1649/ntpd
udp6 0 0 ::1:123 :::* 1649/ntpd
udp6 0 0 :::123 :::* 1649/ntpd
sudo lsof -nP -i | grep LISTEN
sshd 1477 root 3u IPv4 14216 0t0 TCP *:33333 (LISTEN)
sshd 1477 root 4u IPv6 14218 0t0 TCP *:33333 (LISTEN)
mysqld 1527 mysql 22u IPv4 18444 0t0 TCP 127.0.0.1:3306 (LISTEN)
master 2018 root 12u IPv4 18107 0t0 TCP 127.0.0.1:25 (LISTEN)
master 2018 root 13u IPv6 18108 0t0 TCP [::1]:25 (LISTEN)
nginx 4707 root 6u IPv4 43893 0t0 TCP *:80 (LISTEN)
nginx 4707 root 7u IPv6 43894 0t0 TCP *:80 (LISTEN)
nginx 4707 root 8u IPv4 43895 0t0 TCP *:443 (LISTEN)
nginx 4707 root 9u IPv6 43896 0t0 TCP *:443 (LISTEN)
nginx 4708 www-data 6u IPv4 43893 0t0 TCP *:80 (LISTEN)
nginx 4708 www-data 7u IPv6 43894 0t0 TCP *:80 (LISTEN)
nginx 4708 www-data 8u IPv4 43895 0t0 TCP *:443 (LISTEN)
nginx 4708 www-data 9u IPv6 43896 0t0 TCP *:443 (LISTEN)
nginx 4709 www-data 6u IPv4 43893 0t0 TCP *:80 (LISTEN)
nginx 4709 www-data 7u IPv6 43894 0t0 TCP *:80 (LISTEN)
nginx 4709 www-data 8u IPv4 43895 0t0 TCP *:443 (LISTEN)
nginx 4709 www-data 9u IPv6 43896 0t0 TCP *:443 (LISTEN)1 Answer
In Ubuntu, Port 25 is used for SMTP, for sending mails which is different from receiving mails using POP3 or IMAP and its auto enable in server. So it cannot affect to port and service you change.
In Case, if you want to find out, which exact program is responsible for an open port, type:
sudo fuser -v 25/tcpSecond, if you want to stop the program, you could use command as:
sudo stop exim4 or sudo stop exim
