Nagios Support Forum

Hello:
I had my security guy check to see if we are applying good security practices and had him run a scan against our Nagios XI monitoring server.
He identified the following:
"
For the most part things look good. There are a few open ports that I would question both why they are open and what is using them.
Those ports are:
5666
8400
8402
9998
There are more ports open of course, but they are easily identified (ssh, apache, ntp, etc..)
"
I am noting that it's obvious that we would need to allow for port 5666 for NRPE checks, but what would you suggest to keep and/or close - I'm thinking at least 9998 should be?
Thank you.

Yes, tcp port 5666 is for NRPE checks,(usually it's open on the client box that you are monitoring via NRPE). I am not sure about the rest of the ports, but you can probably run nmap against these ports and try to identify what they are used for...
for udp ports

You may freeze this post.

We'll go ahead and close this thread. Thanks.