Problem: I am trying to determine which ports to open for specific programs
I have a number of programs that need to access services on remote hosts, but I don't know which ports they are trying to use for the purpose. Rather than opening the firewall up to 0-1024
(or 0-65k
), I would like to identify which ports a program uses while it runs.
The first program to check is kinit
. From the documentation I gather that I need to open port 88
for inbound udp traffic and port 88
for outbound tcp and udp traffic. But this does not seem to be enough, as the program responds with
kinit: Resource temporarily unavailable while getting initial credentials
Opening up all ports results in a correct authentication flow for kinit
:
Using default cache: /tmp/krb5cc_16381
Using principal: *****@******.******.***
Password for *****@******.******.***:
Authenticated to Kerberos v5
I know about how to use lsof
, netstat
and ss
for retrieving the open ports for processes that bind for longer duration of periods to ports, but especially kinit
seems to elude this listing, even when used together with a tool such as watch
.
Edit: The accepted answer immediately showed me the culprit: DNS;
strace -e trace=connect kinit <user>@<kdc>
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("<kdc_ip>")}, 16) = 0
Opening this port fixed the problem with Kerberos