Re: what using these mail ports and how do i turn them off

["Chris Timmons" <chris@computar.ca>]

Are you running the scan from a box with an antivirus on it, such as
NAV? If so, the ports will always show up as open since your machine is
proxying those ports.

-----Original Message-----
From: neal hamilton [mailto:nealhamiltonjr@yahoo.com] 
Sent: Thursday, March 21, 2002 2:49 PM
To: Misc@Openbsd. Org
Subject: what using these mail ports and how do i turn them off


Just got my openbsd 3.0 router setup. I followed all the hardening faqs:
about how to turn off services etc... and did so. Even sendmail has been
shutdown as you can see from the ps below. I wanted to scan the machines
ports before putting it on the internet and upon doing so the scanner
shows port 25 and 110 open for mail. What could be listening on smtp:25
and pop:110. the only thing showing up listening should be port 22 for
ssh.


Everything in inetd is turned off and I think only pf is set to yes in 
rc.conf. here is a ps of the system:

ps -aucx | more
USER       PID %CPU %MEM   VSZ   RSS TT   STAT STARTED       TIME
COMMAND
root     15204  0.0  1.0   132   648 p0  S+     1:37PM    0:00.06 more
root      8801  0.0  0.5   384   292 ??  Is     1:24PM    0:00.04
dhclient
root     30751  0.0  0.7   100   452 ??  Ss     1:24PM    0:00.23
syslogd
root     31997  0.0  1.8   332  1160 ??  Is     1:25PM    0:01.25 sshd
root     23629  0.0  0.8   224   536 ??  Is     1:25PM    0:00.09 cron
root     30996  0.0  0.7    44   424 C1  Is+    1:25PM    0:00.04 getty
root     28385  0.0  0.7    44   424 C2  Is+    1:25PM    0:00.04 getty
root      2863  0.0  0.7    44   424 C3  Is+    1:25PM    0:00.04 getty
root     29068  0.0  0.7    44   424 C5  Is+    1:25PM    0:00.04 getty
root      3840  0.0  2.2   380  1472 ??  S      1:28PM    0:01.12 sshd
root     29645  0.0  0.4   344   256 p0  Ss     1:28PM    0:00.15 csh
root      8285  0.0  0.7    44   424 C0  Is+    1:34PM    0:00.04 getty
root      1957  0.0  0.3   276   200 p0  R+     1:37PM    0:00.03 ps
root         1  0.0  0.3   340   212 ??  Is     1:23PM    0:00.07 init

thanks in advance.