Security

Ask something
Discussion Locked

Port(s) Question

0 helpful
10 replies

by d.jones092

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Morning All...just ran a security vulnerability assesment program against one of my Win2k Pro machines. The program indicates the following ports are open:

135 epmap-DCE endpoint resolution
139 netbios SSN netbios
445 MS-DS

Anyone have any ideas on these? I know what the NetBios port is for, however, is it normal for the other two to be open?

10 replies

by vinnyd

In some cases, Microsoft uses port 135 as an RPC Endpoint Mapper. Runs as RPCSS on (some versions of?) Windows. This is a sort of "RPC directory" service which can be used to lookup what ports other services are running on.

On my networks all ofthose ports are closed.

I would not leave them open unless you have a use for them.

by joseph moore

Ok. In Win2K, Microsoft introduced the SMB port, TCP port 445. It is designed to replace the NetBIOS port 139. In a pure Win2K/XP environment, you can disable NetBIOS Over TCP/IP, which shuts down port 139, and run your File and Printer Sharing on port 445.
A Win2K/XP machine that is enabled to use NetBIOS over TCP/IP will try and make all file and print sharing connections on BOTH ports, and whichever port answers first is the one the connection will use.
Here is a good article on port 445:
http://www.ntsecurity.nu/papers/port445/

If this machine you scanned has this port open on its Internet interface, you have got to block that NOW. A hacker could do a dictionary attack against your server, gain access, and download all your files, plus do other damage.

by joseph moore

Now, TCP port 135 is a little more confusing. It is the RPC port that the RPC services use. You can derive service info over this port. It is interesting, actually, what you can get. You can't do any file sharing, but you CAN download the user list from a remote maching over this port (I think!).
I do know you can get service info.
This one is not as much of a danger to have open on the Internet, but I would shut it down at your firewall also, just to be safe.

And of course, port 139 should not be open to the Internet either.

hope this helps

by sfhsgrad00

To be honest, not exactly sure what the ports are for, however if your concerned with system vulnerability, I would suggest putting a firewall of some type on your system. I recommed ZoneAlarm Pro. The firewall will restrict access to these and other ports on your system, making your system less vulnerable to intrusion.

by guyver

Do you use file sharing on that system? If not, then remove the File and Print Sharing from your Network configuration. That will close/remove port 445

You can disable NetBIOS in the TCP/IP properties if you don't need to lookup or connect to the system on a Microsoft network. That will take care of port 139.

Set your Local Security Policy "Security Options" so Anonymous Users cannot enumerate the SAM. To keep users from port 135.

If you need File/Printer Sharing and NetBIOS, then you can set IPSec filters to block traffic to your allow only your intranet and particular ports for the internet (HTTP, HTTPS).

The firewall option is also good, but in can be a hassle to setup, not to mention the money. Some firewall apps are free for individual use, but cost for business.

I use ZoneAlarm Pro on my systems, I like the pop-up when telling me someone is trying to access my system and being able to "look them up". On the systems in my department, I'm using IPSec filtering and limit incoming traffic to our intranet and some ports to the internet.

This discussion is closed to new replies.