PF: strange port 21

[iwi]

Good day !

1. I set PF policy: "block all"
2. scan openbsd 4.4.
3. Scanning result - system offline


1. I set PF policy:

set skip on lo
scrub in all
block all
pass in on bge0 proto tcp from any to 192.168.0.2 port {22,80}

2. scan
3. Open ports:
21 - ftp
22 -ssh
80 - http


ps aux | grep ftp ---> no

21 ftp --- What it is ???

[jggimi]

Q1: How are you doing your "scan" ? From where?

Q2: Do you have any equipment on your local network (such as a SOHO router) between your OpenBSD system and the scanning server? If there is a NAT translation between your OpenBSD system and the scanning machine, that NAT platform may have port 21 open.

Port 21 is used as the incoming (listening) port for ftp servers. If you have a default installation, the port is one of several managed by inetd(8), which starts ftpd(8) when incoming packets are sent to that port. But in the default installation, inetd.conf(5) is configured with ftpd disabled, so the port would not be open.

If you issue:

$ netstat -an | grep LISTEN

you should see if port 21 is open or not.

If it is, the command:

$ fstat | grep ":21"

should tell you what process has opened it.

[iwi]

I installed openbsd 4.4 on my workstation and scan it from notebook (windows xp).

workstation----switch----notebook

I checked all possible sources of appearance 21 port:

1.ps aux |grep ftp
2.cat /etc/inetd.conf |grep ftp
3. netstat
4. fstat
5. (from windows xp) telnet my_workstation 21 (grab banner)

nothing


Then i decided to scan workstation from unix system . I was suprising when saw that nmap shows only 22, 80 port.

To my mind it is trouble of scanner on windows xp. But i don't understand, why i can connect to workstation from windows xp by "telnet workstation 21"

[iwi]

it's not openbsd problem !!!!

Trouble with windows XP