Samba open ports, not being filtered

Question

nmap scan of my ubuntu computer, output when ran with -sV:

139/tcp  open  netbios-ssn         Samba smbd 3.X (workgroup: MEDIAPC)
445/tcp  open  netbios-ssn         Samba smbd 3.X (workgroup: MEDIAPC)

I know what other services are being run but I do not know what is being run on 139 or 445. I did a little bit of googling and found:

http://www.speedguide.net/port.php?port=445

http://www.speedguide.net/port.php?port=139

Both of these sound like they are related to windows and or file sharing in windows. My computer is set up with a samba share, but nothing I would want broadcast over the web.

I am wondering, are these ports actually open? If so, should they be? From the googling I did it sounded like a lot of people have these ports show up as "filtered" yet mine are showing up as "open".

I am mainly wondering because I have disabled UPnP and figured this would mean I would have an idea of all my open ports. I was not expecting to see 139 or 445 tcp ports open so I wondering if there is some reason for this. Just looking to possibly learn more about my network and increase security.

nmap scan for my router using -sV:

Nmap scan report for router.asus.com (192.168.1.1)
Host is up (0.011s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE     VERSION
53/tcp   open  domain      dnsmasq 2.76-g0007ee9
80/tcp   open  http        httpd/2.0
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
8200/tcp open  upnp        MiniDLNA 1.1.5 (Linux 2.6.38-11-generic-pae; DLNADOC 1.50; UPnP 1.0)

Answer 1

Since you already know you're running Samba, then explaining that running netstat -nap as root on the host will tell you what daemon is listening is somewhat redundant - but worth mentioning for anyone else reading this in future.

I only ever want the samba share to be able to be seen within my LAN.

You've told us nothing about how your LAN connects to other networks. Assuming that this not part of a larger corporate network, but just a domestic / small office environment, then presumably you have some sort of router. Even very basic internet routers provide the capability to block ports. And it would be very unusual in this context to have anything other than a single masqueraded IP address. In such a case, unless you have explicitly enabled port forwarding on the router (or the router is compromised) the outside world will not be able to connect to your server. Having said that, I would consider it good practice to block the router from connecting to these services on the host itself with IPtables. Although there are gui tools (such as Firestarter) it may be difficult to add a rule to exclude specific hosts from access.

Of course, if my assumptions about your network are different, then the solution is different.

Answer 2

Anyone over the internet can SMB connect to your workstation if

• Router is port forwarding SMB to you. To check try smbclient \\\\router_ip\\smb_share_name.

• Router is not properly configured to block port forwarding request from external networks.

The best thing you can do is to firewall SMB ports to all IP's except internal IP's using iptables.