Open ports Acronis Linux Agent
Dear Acronis Team,
i thought the Acronis Agents only does outgoing connections and does not open any incoming public ports.
But after updating to the newest agent (12.5.10170) there are now 3 open ports on our machines in listen state and bound to every ip on the system:
tcp 0 0 0.0.0.0:9850 0.0.0.0:* LISTEN 24115/mms
tcp 0 0 0.0.0.0:43234 0.0.0.0:* LISTEN 24115/mms
tcp6 0 0 :::9876 :::* LISTEN 24189/acronisagent
Can you please check why these ports are now permanently open on public system ips?
Greetings,
Dominik

- Anmelden, um Kommentare verfassen zu können

I just tried blocking these 3 ports by a iptables rule. But now the backup is failing with a socket error. Can you please help what is wrong here?
I use the following iptables rule:
iptables -I INPUT -p tcp -m tcp -s 0.0.0.0/0 -m multiport --dports 9876,9850,43234 -j REJECT --reject-with tcp-reset
- Anmelden, um Kommentare verfassen zu können

Hello, Dominik!
These ports were merged as part of the code from the on-premise branch of Acronis Backup family of products.
Current agent require these ports to be open.
We will fix this in upcoming 7.8 and add that info to the documentation.
Hope that covers it!
- Anmelden, um Kommentare verfassen zu können

Is there a documentation for which IP addresses those ports need to be open? We can not fully open them up.
In our ticket your support said that we can completely close them, but as you wrote, that does not work. :(
- Anmelden, um Kommentare verfassen zu können

Hello DominikD,
Could you please share the ID of the related support ticket?
- Anmelden, um Kommentare verfassen zu können

Dear Ekaterina,
we have access to a 7.8 beta and the problem is solved there. The ports are bound to localhost and not open towards internet anymore.
But we have another problem. During every backup the "service_process" opens a totally random port towards internet. Here the netstat output from two different backup runs:
tcp 0 0 0.0.0.0:37019 0.0.0.0:* LISTEN 6563/service_proces
tcp 0 0 0.0.0.0:40159 0.0.0.0:* LISTEN 6883/service_proces
With our open port monitoring we get a notification during every single backup because a port is opened to public internet. Would it be possible for your development to also bind this random port (which is only open during backup) to localhost?
- Anmelden, um Kommentare verfassen zu können