0200-listening-ports-add - New Host Port Opened¶

Rule ID¶

• 0200-listening-ports-add

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• A port is the translation of the English term "port," which can be considered an exit for a device to communicate with the outside world. Ports can be divided into virtual ports and physical ports. Virtual ports refer to ports inside a computer or within switches and routers, which are invisible. For example, port 80, port 21, and port 23 on a computer. Physical ports, also known as interfaces, are visible ports, such as the RJ45 network port on the back of a computer, the RJ45 ports on switches, routers, and hubs. The RJ11 jack used by telephones also falls under the category of physical ports.

Scan Frequency¶

• 1 */5 * * *

Theoretical Basis¶

• An unknown port being added to a host may cause data leakage risks.

Risk Items¶

• Hacker intrusion
• Data leakage
• Network security
• Cryptomining risk
• Botnet risk

Audit Method¶

• Execute the following command to find the port numbers on Linux:

  netstat -nltp
  

  Ensure that the port is one you are aware of.

Remediation¶

• Execute the following command to remove unknown risky port numbers:

  netstat -anp |grep you port
  kill -9 PID
  

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None