Direkt zum Inhalt

Open ports Acronis Linux Agent

Thread needs solution

Dear Acronis Team,

i thought the Acronis Agents only does outgoing connections and does not open any incoming public ports. 

But after updating to the newest agent (12.5.10170) there are now 3 open ports on our machines in listen state and bound to every ip on the system:

tcp 0 0 0.0.0.0:9850 0.0.0.0:* LISTEN 24115/mms

tcp 0 0 0.0.0.0:43234 0.0.0.0:* LISTEN 24115/mms

tcp6 0 0 :::9876 :::* LISTEN 24189/acronisagent

Can you please check why these ports are now permanently open on public system ips?

Greetings,

Dominik

0 Users found this helpful
frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Beiträge: 250
Kommentare: 7092

Hello Dominik,

Sorry for the delayed response! The ports 9876, 9850 and 43234 should not be open. It's a known issue that is planned to be permanently fixed in Acronis Data Cloud 7.8. Meanwhile, the ports can be safely blocked.

Thank you, 

I just tried blocking these 3 ports by a iptables rule. But now the backup is failing with a socket error. Can you please help what is wrong here?

I use the following iptables rule:

iptables -I INPUT -p tcp -m tcp -s 0.0.0.0/0 -m multiport --dports 9876,9850,43234 -j REJECT --reject-with tcp-reset
 

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Beiträge: 6
Kommentare: 60

Hello, Dominik!

 

These ports were merged as part of the code from the on-premise branch of Acronis Backup family of products.

Current agent require these ports to be open.

 

We will fix this in upcoming 7.8 and add that info to the documentation.

 

Hope that covers it!

Is there a documentation for which IP addresses those ports need to be open? We can not fully open them up.

In our ticket your support said that we can completely close them, but as you wrote, that does not work. :(

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Beiträge: 250
Kommentare: 7092

Hello DominikD,

Could you please share the ID of the related support ticket? 

Dear Ekaterina,

we have access to a 7.8 beta and the problem is solved there. The ports are bound to localhost and not open towards internet anymore.

But we have another problem. During every backup the "service_process" opens a totally random port towards internet. Here the netstat output from two different backup runs:

tcp        0      0 0.0.0.0:37019           0.0.0.0:*               LISTEN      6563/service_proces
tcp        0      0 0.0.0.0:40159           0.0.0.0:*               LISTEN      6883/service_proces
 

With our open port monitoring we get a notification during every single backup because a port is opened to public internet. Would it be possible for your development to also bind this random port (which is only open during backup) to localhost?