IBM Support

PowerVM Virtual I/O Server Ports Usage

Question & Answer


Question

Can the following ports and services be disabled without impacting the Virtual I/O Server functions?

Cause

Security scan tool is reporting the following open ports. 
Port    Service Name
----    ------------
21      FTP
23      telnet
543     klogin
544     kshell
655     rmcd
1334    writesrv
6080    postgres

Answer

The remaining ports should not be disabled.  Keep in mind the Virtual I/O Server is an appliance.  Unlike AIX, it is restricted as its sole purpose is to virtualize the physical resources.  Therefore, it is not supported to change default configuration without approval from Support.  
FTP and telnet
These ports can be disabled by using viosecure command by applying the rules for those two particular ports as shown next.  Keep in mind that by doing so, access to the Virtual I/O Server is restricted console login.
It is recommended to have up-to-date backups before making any configuration changes.
Login as padmin user and run:
$ viosecure -level high -rule hls_telnet -apply
$ viosecure -level high -rule hls_ftp -apply
Description of these rules:
hls_telnet:Disable telnet: Comments the entry for telnetd daemon in /etc/inetd.conf and refreshes inetd
hls_ftp:Disable FTP: Comments the entry for ftpd daemon in /etc/inetd.conf and kills all instances of ftpd
The remaining ports should not be disabled.  Keep in mind the Virtual I/O Server is an appliance.  Unlike AIX, it is restricted as its sole purpose is to virtualize the physical resources.  Therefore, it is not supported to change default configuration without approval from Support.  
 
klogin and kshell
These ports relate to Kerberos 5 Authentication.
rmcd
The Resource Monitoring and Control daemon is used for various functions on the Virtual I/O Server.  These functions include, but are not limited to dynamic logical partition (LPAR) operations, Live Partition Mobility, and Shared Storage Pool Cluster.
 
writesrv
This service allows users to send messages to and receive messages from a remote system
More details at https://www.ibm.com/docs/en/aix/7.2?topic=w-writesrv-daemon
postgres It is used for Virtual I/O Server database administration.  It is managed by user ID, vpgadmin.
The unix account vpgadmin was primarily created for postgres DB (that is used by SSP and CMDB).
There is no password set for vpgadmin, which blocks remote access to the user.
As with any user which comes configured with the installation virtual I/O server, this user should not be removed or disabled as that can result in unpredictable results and will leave the Virtual I/O Server in an unsupported configuration.
How to Determine What May be Using a Specific Port
You can grep /etc/services for a default port number.  However, an application may use a different port. 
In general, to determine which application is using a specific port, use the nestat -Aan,  rmsock, and ps commands via oem_setup_env shell to get the process name. 
Example: To check what is using port 1334
1. First, grep for the port number from the port scan  in the netstat output.   It will produce a socket id.  For example:
$ oem_setup_env
# netstat -Aan | grep 1334                   --> shows listening
f10010000653a3b8 tcp4       0      0  *.1334                *.*                   LISTEN
2. Once you have a socket id, use the following command to identify the process. 
Be sure to substitute your socket id.
# rmsock f10010000653a3b8 tcpcb
The socket 0xf10010000653a008 is being held by proccess 8913272 (writesrv).
3. Next, use the PID found with the ps command and get the process name and path:
# ps -ef|grep 8913272
    root  8913272  5308882   0   Jun 07      -  0:00 /usr/sbin/writesrv
In this example, the process listed is writesrv. 

[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSPHKW","label":"PowerVM Virtual I\/O Server"},"ARM Category":[{"code":"a8m50000000L0MTAA0","label":"PowerVM VIOS-\u003EGeneral VIOS Resources"}],"ARM Case Number":"TS005654513","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"3.1.0;3.1.1;3.1.2"}]

Document Information

Modified date:
26 February 2024

UID

ibm16458253

Page Feedback