Public listening ports
high on-server
What it inspects
`ss -tln` as root, taking LISTEN sockets bound to 0.0.0.0, [::] or * and comparing the ports with the allow-list 22, 80 and 443 (the SCANNER_LISTEN_ALLOWLIST variable changes it when you run the scanner yourself). A port your firewall already drops is not counted, unless Docker or Podman may publish it. One unexpected port warns, two or more fail, and a port that is only firewalled gives an informational warning. Sockets bound to one specific address are not counted. If ss gives no output, it is skipped.
Why it matters
The classic mistake is a database, cache or admin panel that listens on every address and was only meant for local use. Anything bound to all addresses is reachable from the internet unless a firewall stops it, and unauthenticated or weakly protected services are found by scanners within hours.
How to verify
sudo ss -tlnpHow to fix
Judgement step: for each unexpected port, bind the service to loopback, restrict it by firewall, or stop it. The right choice depends on what the service is for.
Decide what each unexpected listener should be needs your judgement
Any distro
# See what listens and which process owns it:
# ss -tlnp
# This check lists sockets bound to all addresses (0.0.0.0, [::] or *) on ports other than 22, 80 and 443.
# For each one decide whether it must be reachable from the internet, then choose ONE:
# a) Bind it to loopback in the service's own configuration, then restart that service. Examples:
# PostgreSQL: listen_addresses = 'localhost' (postgresql.conf)
# MySQL / MariaDB: bind-address = 127.0.0.1 (server config)
# Redis: bind 127.0.0.1 -::1 (redis.conf)
# systemd-resolved: LLMNR=no in /etc/systemd/resolved.conf, then systemctl restart systemd-resolved
# Docker: publish with -p 127.0.0.1:<host port>:<container port>
# b) Keep it public on purpose, and restrict who can reach it with a firewall rule limited to known addresses.
# c) Stop and disable the service if nothing needs it: systemctl disable --now <unit>
# A port that your firewall already drops is reported only as an informational warning. Binding it to loopback
# removes that warning too and protects you if the firewall rules change later.
# If you run the scanner yourself and a port really is meant to be public, list it in SCANNER_LISTEN_ALLOWLIST
# (comma-separated, for example 22,80,443,5432) instead of opening anything.
# One unexpected port is a warning; two or more fail.