不同的 nmap 结果

Question

我从外部和内部对服务器进行了扫描，为什么结果不同？

[root@xxx ~]# nmap -sV -p 0-65535 localhost

Starting Nmap 5.51 ( http://nmap.org ) at 2011-02-16 07:59 MSK
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000015s latency).
rDNS record for 127.0.0.1: localhost.localdomain
Not shown: 65534 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.3 (protocol 2.0)
80/tcp open  http    Apache httpd 2.2.3 ((CentOS))

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.99 seconds

和

sh-3.2# nmap -sV -p 0-65535 xxx.com

Starting Nmap 5.51 ( http://nmap.org ) at 2011-02-16 00:01 EST
Warning: Unable to open interface vmnet1 -- skipping it.
Warning: Unable to open interface vmnet8 -- skipping it.
Stats: 0:07:49 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 36.92% done; ETC: 00:22 (0:13:21 remaining)
Stats: 0:22:05 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 75.00% done; ETC: 00:23 (0:00:02 remaining)
Nmap scan report for xxx.com (x.x.x.x)
Host is up (0.22s latency).
Not shown: 65528 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  tcpwrapped
22/tcp   open  ssh         OpenSSH 4.3 (protocol 2.0)
25/tcp   open  tcpwrapped
80/tcp   open  http        Apache httpd 2.2.3 ((CentOS))
110/tcp  open  tcpwrapped
143/tcp  open  tcpwrapped
443/tcp  open  tcpwrapped
8080/tcp open  http-proxy?

Answer 1

ssh 和 http 都有一个 INADDR_ANY 监听器，所以您可以在环回和外部 iface 上看到它们（netstat -naltp 将显示 ssh 在 0.0.0.0:22 上监听，http 在 0.0.0.0:80 上监听）。

tcpwrapped 和 http-proxy 仅在外部 iface 上监听。

Answer 2

两件事情：

1. 这可能是由于防火墙的配置方式所致。扫描 localhost 时，它会绕过适用于真实接口（如 eth0）的防火墙规则，并查找正在侦听的所有服务。

2. 通常，将网络服务设置为仅监听特定接口是一种很好的安全做法。例如，可以将端口 8080 上的 http-proxy 配置为忽略本地主机上的请求。