RE: [cobalt-security] Ports safe to close?

[Graeme Fowler <graeme.fowler@xxxxxxxxxxxxxx>]

Clive Harper wrote:

> I just ran nmap against one of our development RAQ's and it
> came back with
> 
> 3001/tcp open nessusd
> 
> I have never installed nessus on this box and it has never been
> open to the internet as it is a development box.

No, but you have a copy of Chili!Soft ASP running, right?

The service descriptions nmap returns are simply matched from a file. In
this case, that line says "3001 nessusd".

Familiarise yourself with your normal services - nmap can only report what
it *thinks* a service on a particular port is; it doesn't actually test and
diagnose the service for you!

Graeme
-- 
Graeme Fowler
System Administrator
Host Europe Group PLC