I'm setting up a new debian server and I don't need FTP so I want to remove it. According to netstat -tap, ftp isn't listening on anything. However when I do a port scan (nmap) externally it says the ftp port is open (21). inetd isn't starting anything, xinetd isn't on the system.
What should I do?
result of netstat tap
obu1:/etc/pam.d# netstat -tap Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:225 *:* LISTEN 2237/sbadm tcp6 0 0 *:ssh *:* LISTEN 2399/sshd tcp6 0 448 obu1.hostname.:ssh rrcs-XXX-XXX-XXX-XXX:56721 ESTABLISHED 16639/sshd: username
NMap from non-local
Starting Nmap 4.90RC1 ( http://nmap.org ) at 2009-07-13 10:47 Eastern Daylight Time Interesting ports on obu1.hostname (ipaddress): Not shown: 972 closed ports, 26 filtered ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh Nmap done: 1 IP address (1 host up) scanned in 3.60 seconds
Best Answer
You should know that Windows XP (and probably other versions) has an internal wrapper for FTP connections (the purpose of this is to try to allow PORT command to complete successfully, even behind a firewall or a router).
This wrapper intercepts any connection to any host on port 21, so it can monitor it and try to open the incoming port of a PORT command issued by the client.
This wrapper also has a side effect: as it intercepts any connection to a port 21, it sends a signal that the connection has been established to the software, which will see the connection as established, but the connection is really established only to Windows's internal wrapper.
The wrapper then tries to open the connection to the real host, and if it timeouts, then it sends a signal to the software that the connection has been lost. The software will see the connection as lost.
Summing this up, the software believes a connection has been successfully established, then lost, but no real connection has been established.
So, in your case, what happens: you run nmap. Nmap tries to connect to your server on port 21. Windows's wrapper intercepts the connection. Nmap "thinks" it is connected to your server (but it's only connected to the wrapper), and reports the port as opened.
You can confirm this by typing in a command line:
ftp 4.3.2.1
You'll see: C:>ftp 4.3.2.1
Connected to 4.3.2.1.
Connection closed by foreign host.
You can try any valid IP, ftp will always connect, and disconnect shortly after, whereas it should report "Connection timed out".
I never saw any documentation about this. After many investigation, I discovered this strange behavior, and after more investigation, discovered why it is here.
Well, the conclusion of this (big) answer is that the port 21 of your server is definitely closed, as netstat reports, and nmap is fooled by this behaviour.