SMB/NetBIOS active on iSCSI-R3?

Printable View

09-04-2007, 08:09 AM
CraigB

SMB/NetBIOS active on iSCSI-R3?

I just noticed that on my iSCSI-R3 box that there are a ton of ports open that I have no need for. Is there any way to disable stuff like NetBIOS, SMB file sharing, POP3/IMAP, etc? The list below shows all the stuff that is turned on by default (and I can't see anything in the web UI to turn it off)...

Thanks

Craig

Round Trip Time (RTT): <10 ms
Time To Live (TTL): 64
DNS name: iscsi.xxx..xxx
NetBios names (5) ISCSI <00> UNIQUE - Workstation service
ISCSI <03> UNIQUE - Messenger service
ISCSI <20> UNIQUE - File server service
WORKGROUP <1E> GROUP - Browser Service Elections
WORKGROUP <00> GROUP - Domain name

User: ISCSI
MAC: xx:xx:xx:xx:xx:xx
Comment: iSCSI
Platform: 500
Version: 4.9
Roles: (7) LAN Manager workstation
LAN Manager server
Server sharing print queue
Unix server
Windows NT/Windows 2000/Windows XP workstation or server
Windows NT/Windows 2000 server that is not a domain controller
DFS Server

Remote Supports Supported Remote Administration Protocol
Supported Remote Procedure Call
Supported Security Account Manager

Remote Time of Day Time of Day: 04/09/2007 8:56:10 AM
System loaded: 04/09/2007 2:56:10 AM
Time Zone: -120 minutes from the Greenwich Mean Time (GMT) zone

Users (0)
Password policy Minimum password length: 5
Maximum password age:
Minimum password age: none
Force logoff: 4294967295 sec
Password history: 0
Time before it is automatically unlocked: 1800 sec
Time between any two failed logon: 0 sec
Number of invalid password : 0

Shared ressources (2) ADMIN$
IPC$

Opened files (1) \PIPE\srvsvc User: guest
Permission:

TCP ports (18) 25 smtp => Simple Mail Transfer Protocol
80 http => World Wide Web HTTP HEAD / HTTP/1.0
110 pop3 => Post Office Protocol - Version 3
119 nntp => Network News Transfer Protocol
139 netbios-ssn => NetBios Session Service
143 imap4 => Interactive Mail Access Protocol v4
389 ldap => Light Directory Access Protocol
443 https => Http protocol over TLS/SSL
445 microsoft-ds => Microsoft-DS
993 imaps => Imap4 protocol over TLS/SSL
995 pop3s => Pop3 protocol over TLS/SSL
1080 socks => Socks 4/5
3128 proxy => HTTP(S) Proxy
6666 irc => Mirc
6667 irc => Mirc
6668 irc => Mirc
6669 irc => Mirc
8080 http => HTTP Alternate (see port 80)
09-04-2007, 08:25 AM
CraigB

LDAP open to anonmyous access as well

Also just noticed that the LDAP server that's open on the iSCSI box supports anonymous bind so you can connect without any credentials...

Craig
09-04-2007, 03:58 PM
To-M

Craig,

I know this has been a concern for many recently and our Research and Development Department will look into this and disable these ports, but this will take time or next releases (not sure which one). I know this is not the answer you want to here but in the mean time try using a Router/Firewall to block these ports (outside and & inside). This is a problem being a Storage system that we will have to look into.:(
09-05-2007, 08:48 AM
CraigB

Thanks Todd. Glad to hear that its on the to-do list and hopefully it will be along shortly. For us the iSCSI box isn't internet accessible, but having all the unused ports open, and particularily that anonymous LDAP bind runs afoul of corporate security policy so I can't get it put onto a production network segment until that is resolved.

An ideal resolution for this kind of thing moving forward would be to allow administrator ssh access to a shell as this stuff wouldn't be hard to turn off with a couple of .conf file changes. This is the approach the VMware guys take with their service console...

Craig
09-06-2007, 01:26 PM
To-M

Craig,

Can you send the log file to support@open-e.com on the subject line please enter
RefID#10004850 for the ticket that we have created for you.

Thanks!
09-07-2007, 05:53 AM
CraigB

Hi Todd. Which log file do you want me to send to support? The portscan that I posted or something from the Open-E box?

Craig
09-07-2007, 01:43 PM
To-M

Just send the whole log file.
09-24-2007, 08:28 PM
netsyphon

im a minimalist which is why i bought open-e ISCSI. but instead i get all the bloat of DSS without the functionality.

dont you think that removing these un-needed services may help the performance and stability of the system?

looks like open-e is also using the default debian etch kernel?
09-24-2007, 08:48 PM
To-M

Not sure what the complaint is DSS or iSCSI-R3? What are the un-needed services you are referring to - need details? Then we can ask others what their opinions are as well. We are looking into giving more control to the user on some of these services but at a later date. And yes we are using debian etch, this is easy to identify with the logs. What distros have you developed or have tested with results? Need more details to support the use of your discussion.
09-25-2007, 03:00 PM
netsyphon

Quote:

Originally Posted by To-M

Not sure what the complaint is DSS or iSCSI-R3? What are the un-needed services you are referring to - need details? Then we can ask others what their opinions are as well. We are looking into giving more control to the user on some of these services but at a later date. And yes we are using debian etch, this is easy to identify with the logs. What distros have you developed or have tested with results? Need more details to support the use of your discussion.

heres my nessus summary, if you want the actual report let me know:

unknown (842/tcp)
https (443/tcp)
vampire (6669/tcp)
unknown (25456/tcp)
irc-serv (6666/tcp)
unknown (4702/tcp)
unknown (11798/tcp)
vocaltec-gold
unknown (25457/tcp)
ircd (6667/tcp)
netbios-ssn (139/tcp)
sunrpc (111/tcp)
http (80/tcp)
iscsi-target (3260/tcp)
microsoft-ds (445/tcp)
ldap (389/tcp)
irc (6668/tcp)
prosiak (22222/tcp)
cddbp (888/tcp)
sunrpc (111/udp)
unknown (840/udp)
netbios-ns (137/udp)
ntp (123/udp)

Thats the open ports on a iscsi-r3 box. The only things I'm expecting are 3260 and 22222!

possible that Xinetd is enabled? why would I see IRC!
09-25-2007, 03:46 PM
To-M

Please send logs to support about this. We need to review them on these ports. Thanks for bringing this up!
09-25-2007, 04:45 PM
netsyphon

ok i sent it to support@open-e.com

thanks for looking into this :)
09-25-2007, 05:09 PM
To-M

Any way you can send the logs from Status > Hardware > Log then click on the "Download" button so we can get the whole log file? Thanks for sending this!
09-25-2007, 08:01 PM
netsyphon

sent that as well
10-03-2007, 12:07 AM
To-M

NetBios is enabled as it should be to access server
over IP and name.

Also we don’t have IRC server, this port is used with raid tools
(even if this tool is not used our port server lock it).

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State PID/Program name
tcp 0 0 0.0.0.0:389 0.0.0.0:*
LISTEN 12962/slapd
Needed for SMB

tcp 0 0 0.0.0.0:842 0.0.0.0:*
LISTEN 9992/drbd_rpc
Needed for replication

tcp 0 0 0.0.0.0:6666 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:139 0.0.0.0:*
LISTEN 12595/smbd
So you will see server in network neighborhood

tcp 0 0 0.0.0.0:6667 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:6668 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:6669 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:22222 0.0.0.0:*
LISTEN 12845/sshd
Administrator access for console

tcp 0 0 0.0.0.0:6670 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:111 0.0.0.0:*
LISTEN 9987/portmap
Needed for RPC

tcp 0 0 0.0.0.0:80 0.0.0.0:*
LISTEN 13017/apache-ssl
WWW access

tcp 0 0 0.0.0.0:25456 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:25457 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:11798 0.0.0.0:*
LISTEN 7221/portreserve
Reserved for raid tools

tcp 0 0 0.0.0.0:888 0.0.0.0:*
LISTEN 11484/3dm2
3ware raid tools

tcp 0 0 0.0.0.0:443 0.0.0.0:*
LISTEN 13017/apache-ssl
WWW access

tcp 0 0 0.0.0.0:3260 0.0.0.0:*
LISTEN 12292/ietd
iSCSI protocol

tcp 0 0 0.0.0.0:445 0.0.0.0:*
LISTEN 12595/smbd
So you will see server in network neighborhood

tcp 0 0 0.0.0.0:4702 0.0.0.0:*
LISTEN 7221/portreserve
Reserved

udp 0 0 192.254.17.56:137 0.0.0.0:*
12591/nmbd
udp 0 0 10.40.4.150:137 0.0.0.0:*
12591/nmbd
udp 0 0 0.0.0.0:137 0.0.0.0:*
12591/nmbd
udp 0 0 192.254.17.56:138 0.0.0.0:*
12591/nmbd
udp 0 0 10.40.4.150:138 0.0.0.0:*
12591/nmbd
udp 0 0 0.0.0.0:138 0.0.0.0:*
12591/nmbd
So you will see server in network neighborhood

udp 0 0 0.0.0.0:840 0.0.0.0:*
9992/drbd_rpc
Needed for replication

udp 0 0 0.0.0.0:111 0.0.0.0:*
9987/portmap
Needed for RPC

udp 0 0 10.40.4.150:123 0.0.0.0:*
10944/ntpd
udp 0 0 192.254.17.56:123 0.0.0.0:*
10944/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:*
10944/ntpd
Time synchronization
10-04-2007, 07:08 PM
netsyphon

ok we have been pen-testing this since last night (mini hackathon lol) and what i have initially found is that there is no way to access these services - which is what i expected.

what i really wanted to hint at for this wasnt that we didnt trust that they were configured properly by open-e; just that if i purchase an ISCSI-R3 product im still running all these DSS'ish services :)

so in the food chain all dev work is done on DSS then flows out to ISCSI product, maybe before putting the "big red bow" on the ISCSI-R3 product, they could for example:

"/etc/init.d/samba stop" etc. etc.

make sense? its really the only difference in my performance variances between gentoo (my bootstrapped, hand built iscsi box which took 4 hours to get set up) and open-e. i have 2 ports open in gentoo - 3260,22 :) it was only about a 2% difference in performance and that small of a difference is completely trivial when you are talking about something that peaks at 128mb/s on a single gbe link.
10-04-2007, 07:50 PM
To-M

Thanks for the update. I will send this to our research and development team and se if we can have this excluded with iSCSI-R3. Again excellent work!