Exposed Services & Port Scanning
Identify open ports and exposed services on your server.
Exposed Services & Port Scanning
LemWatch checks which services and ports are visible on your server's IP address, helping you identify potential security risks.
What Gets Checked
- Open ports — Which TCP ports are accepting connections (80, 443, 22, 3306, etc.)
- Running services — What software is responding on each port (Apache, Nginx, MySQL, SSH)
- Service versions — Detected software versions (which may have known vulnerabilities)
- Known vulnerabilities — CVEs associated with detected service versions
- Risk assessment — Overall risk level based on exposed services
Risk Levels
Level — Description —
Low — Only expected ports open (80, 443) —
Medium — Admin ports open (22/SSH) but properly configured —
High — Database ports exposed (3306, 5432) or outdated services —
Critical — Known vulnerabilities in exposed services —
Common Issues
- Database ports open — MySQL (3306), PostgreSQL (5432), MongoDB (27017) should never be publicly accessible
- FTP port open — Port 21 is insecure; use SFTP (port 22) instead
- Admin panels exposed — phpMyAdmin, cPanel, or custom admin on public ports
- Outdated software — Running old versions of Apache, Nginx, or OpenSSH with known CVEs
How to Fix
- Close unnecessary ports — Use firewall rules (iptables, ufw, or cloud security groups)
- Update software — Patch services to the latest versions
- Use VPN for admin access — Don't expose SSH, databases, or admin panels publicly
- Move databases behind a firewall — Database servers should only accept connections from your application servers