API to portscan your own servers. reddit / freebsd ---------------------------------------------------------------------- jb-schitz-ki · 2023-07-24 14:57 This is not a specific FreeBSD question, but Im asking here since this is the community I trust. I manage 50+ FreeBSD servers and I would like to portscan them periodically to monitor that no servers have unwanted open ports/services. Ideally every hour. I've been googling around for some sort of API, portscan as a service subscription, but havent found anything. The closest Ive found is: [https://hackertarget.com/nmap-online-port- scanner/](https://hackertarget.com/nmap-online-port-scanner/) which almost does what I want except that it only portscans known ports, and I want it to portscan everything. Im thinking I might even build it if such a service does not exist. Do any of you have this same requirement? How do you go about it? To add a little more context, these servers are all co-lo or dedicated bare metal, so I dont have access to whatever firewall/router is in front of them, which means I have to manage IPFW on each server. ​ Thanks. ---------------------------------------------------------------------- timvandijknl · 2023-07-24 15:26 > I manage 50+ FreeBSD servers and I would like to portscan them periodically to monitor that no servers have unwanted open ports/services. Ideally every hour. Dunno about your servers, but my servers don't open ports/services on their own. Maybe instead of scanning them every hour, consider reviewing your configurations ? If you are afraid that your servers might open ports/services at random, you should probably be worried about the users and their permissions on your servers instead. Also, why bother scanning them externally when you can simply do `netstat -a -n | grep LISTEN` or `sockstat -l` to get a list of all the open ports ? ---------------------------------------------------------------------- JDGwf · 2023-07-24 15:38 nmap is helpful, but you'll likely have to write your own since only you know which server should have which ports open. ---------------------------------------------------------------------- jb-schitz-ki · 2023-07-24 16:07 Access to these servers is very controlled, but theres a couple people that need root to do their job. Theres never been an incident, but I was trying to be overly cautious and constantly verify nothing is open that should not be. I honestly didnt think about doing a sockstat and verifying locally on each server, I think this is the way to go. Thanks for the help. ---------------------------------------------------------------------- Bitwise_Gamgee · 2023-07-24 17:02 If you have a subscription with any hosting provider offering SSH access to your websites, you can use SSH tunneling to scan yourself from home and know that your results aren't being duplicated. ---------------------------------------------------------------------- mmm-harder · 2023-07-28 22:04 Setup a separate VM and run Nessus on it, with a scheduled scan for your hosts. Don't need to write any new code.