Scanning for Open Ports and Vulnerabilities with Nmap

Nmap (Network Mapper) is an open-source tool that discovers hosts, services, and potential security issues on a network. It helps system administrators and developers understand a server's network by identifying open ports, running services, and operating systems.

To begin, install Nmap on a Linux-based server as a non-root user with sudo privileges. The installation process varies depending on the operating system: for Debian/Ubuntu, use `sudo apt update && sudo apt install -y nmap`; for Rocky Linux and other RHEL-based systems, use `sudo dnf install -y nmap`. Verify the installation by running `nmap --version`.

A basic port scan is the first step, checking the 1,000 most common ports. Run this command: `sudo nmap localhost`. The output indicates open ports like 22 (SSH), 3001 (Nessus), and 5432 (PostgreSQL). Scan for specific service versions with the `-sV` flag, and detect the operating system with the `-O` flag.

The Nmap Scripting Engine (NSE) enables vulnerability detection. Install a sample FTP server, vsftpd, and intentionally create a vulnerability by enabling anonymous login. Use the `ftp-anon` script from NSE on port 21 to detect the vulnerability. The output reveals that anonymous FTP login is allowed, indicating the vulnerability.

To mitigate this vulnerability, edit the vsftpd configuration file to set `anonymous_enable=YES` to `anonymous_enable=NO` and restart the service. Nmap provides a powerful framework for network discovery, service identification, and vulnerability assessment, enabling system administrators to maintain secure and well-maintained systems.