SMB服务在端口445上运行/为什么/什么进程

Question

我目前正试图“加固”我所有的服务器，从我不需要的所有服务开始。

这个是nginx反向代理，metasploit说smb 445 tcp过滤了http://gyazo.com/6adcdcf4982801f481b8338d913545bb。

但是我找不到在这个端口上运行的任何服务: service --status-all。

 [ + ]  bind9
 [ - ]  bootlogs
 [ ? ]  bootmisc.sh
 [ ? ]  checkfs.sh
 [ ? ]  checkroot-bootclean.sh
 [ - ]  checkroot.sh
 [ + ]  cron
 [ + ]  fail2ban
 [ - ]  fetchmail
 [ - ]  hostname.sh
 [ ? ]  hwclock.sh
 [ - ]  kbd
 [ - ]  keymap.sh
 [ ? ]  killprocs
 [ ? ]  kmod
 [ ? ]  modules_dep.sh
 [ - ]  motd
 [ ? ]  mountall-bootclean.sh
 [ ? ]  mountall.sh
 [ ? ]  mountdevsubfs.sh
 [ ? ]  mountkernfs.sh
 [ ? ]  mountnfs-bootclean.sh
 [ ? ]  mountnfs.sh
 [ ? ]  mtab.sh
 [ ? ]  networking
 [ + ]  nginx
 [ ? ]  plymouth
 [ ? ]  plymouth-log
 [ - ]  procps
 [ - ]  quota
 [ - ]  quotarpc
 [ ? ]  rc.local
 [ - ]  rmnologin
 [ - ]  rpcbind
 [ - ]  rsync
 [ + ]  rsyslog
 [ + ]  saslauthd
 [ ? ]  screen-cleanup
 [ + ]  sendmail
 [ ? ]  sendsigs
 [ + ]  ssh
 [ - ]  sudo
 [ - ]  udev
 [ ? ]  udev-mtab
 [ ? ]  umountfs
 [ ? ]  umountnfs.sh
 [ ? ]  umountroot
 [ - ]  urandom
 [ - ]  wide-dhcpv6-client
 [ ? ]  xinetd

谁能帮我指出正确的方向吗？

Samba被完全删除(apt清除samba*)，所以不确定它为什么仍然打开端口445。

很肯定这是一个非常基本的问题，但我的研究没有想出任何东西。

谢谢

netstat -lnp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 LOCALHOST:53        0.0.0.0:*               LISTEN      1586/named      
tcp        0      0 127.0.0.2:53            0.0.0.0:*               LISTEN      1586/named      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1586/named      
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1722/sendmail: MTA:
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1586/named      
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      8772/nginx      
tcp        0      0 0.0.0.0:PORT            0.0.0.0:*               LISTEN      1763/sshd       
tcp        0      0 127.0.0.1:587           0.0.0.0:*               LISTEN      1722/sendmail: MTA:
tcp6       0      0 :::53                   :::*                    LISTEN      1586/named      
tcp6       0      0 ::1:953                 :::*                    LISTEN      1586/named      
tcp6       0      0 :::PORT                 :::*                    LISTEN      1763/sshd       
udp        0      0 LOCALHOST:53        0.0.0.0:*                           1586/named      
udp        0      0 127.0.0.2:53            0.0.0.0:*                           1586/named      
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1586/named      
udp6       0      0 :::53                   :::*                                1586/named      
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     3750021142 1/init              @/com/ubuntu/upstart
unix  2      [ ACC ]     STREAM     LISTENING     3750023597 1662/saslauthd      /var/run/saslauthd/mux
unix  2      [ ACC ]     SEQPACKET  LISTENING     3750021553 101/udevd           /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     3820548573 6223/python         /var/run/fail2ban/fail2ban.sock
unix  2      [ ACC ]     STREAM     LISTENING     3820548623 6225/gam_server     @/tmp/fam-root-
unix  2      [ ACC ]     STREAM     LISTENING     3750023674 1722/sendmail: MTA: /var/run/sendmail/mta/smcontrol

Answer 1

"smb 445 tcp筛选“并不意味着某些内容正在侦听端口445。来自nmap手册页：

过滤过了。意味着防火墙、过滤器或其他网络障碍阻塞了端口，因此Nmap无法判断它是打开的还是关闭的。