Weird messages in logs. Am I hacked?

[tabooki]

Seeing all these weird messages in my bridge logs. Why is it doing this PowerShell and exchange stuff?

[tabooki]

[tabooki]

[tabooki]

Ran an external pretty scanner and discovered I had port 5000 opened. Uh oh. My bad.

[mrlt8]

Please make sure to check the other ports used for streaming as well.

[tabooki]

Weirdness. When I ran an external port scanner assured that Port as opened. But when I look in my firewall logs I don't see any entries for anything hitting it. I double-checked my firewall rooms and I don't have anything allowing Port 5000. Tried asking Chad GBT and and saying that Docker is modifying my rules to allow this traffic.

Does Docker bridge the network directly to the outside? That would explain why it's not hitting my firewall rules. If so, how would I go about ensuring that these ports are not available from the outside

sudo iptables -L -n -v|grep 5000
177 9212 RULE_2 tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:5000 source IP range 10.0.0.1-10.0.0.25
4 ctstate NEW
0 0 RULE_3 tcp -- * * 72.53.xxx.xxx
0.0.0.0/0 tcp dpt:5000
0 0 RULE_2 tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:5000 source IP range 10.0.0.1-10.0.0.25
4 ctstate NEW
1 60 RULE_2 tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:5000 source IP range 10.0.0.1-10.0.0.25
4 ctstate NEW
0 0 RULE_3 tcp -- * * 72.53.xxx.xxx
0.0.0.0/0 tcp dpt:5000
30 1752 ACCEPT tcp -- !br-1237ce6882d8 br-1237ce6882d8 0.
0.0.0/0 172.18.0.2 tcp dpt:5000

[tabooki]

Just checked and if I stop Docker wyze bridge then the port 5000 is no longer opened. Hmmmm is this expected behaviour?

[mrlt8]

Is your whole server exposed to the internet?

You could try adjusting the ports section in your docker compose to only listen on a specific interface:

        ports:
            - 127.0.0.1:1935:1935 # RTMP
            - 127.0.0.1:8554:8554 # RTSP
            - 127.0.0.1:8888:8888 # HLS
            - 127.0.0.1:8889:8889 #WebRTC
            - 127.0.0.1:8189:8189/udp # WebRTC/ICE
            - 127.0.0.1:5000:5000 # WEB-UI

Another option would be to disable the ports on the container and access it over a VPN or Tailscale.

[tabooki]

I used my internal network instead of your 127.0.0.1 and it seems to be working perfectly. Thanks so much.