Question Could someone share their "ss -tulpn" output from AlmaLinux 9?

[Azurel]

Server operating system version

AlmaLinux 9.8

Plesk version and microupdate number

18.0.80#1

I tried to convert my Plesk server from AlmaLinux 8 to AlmaLinux 9 with almalinux8to9. Unfortunately, the conversion did not go smoothly and I ran into several issues, especially with firewalld/Plesk firewall integration. I had to troubleshoot and modify several firewall settings, and now I would like to verify that my current configuration is still normal and that I did not accidentally open or close something that should not be.

Could someone running a similar setup please share the output of ss -tulpn from their server? I am mainly interested in comparing which services and ports are normally listening after a standard installation. (Please remove any public IP addresses or other sensitive information before posting.)

Thanks a lot!

# ss -tulpn
Netid State  Recv-Q Send-Q          Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0                   127.0.0.1:323        0.0.0.0:*    users:(("chronyd",pid=34736,fd=5))
udp   UNCONN 0      0                       [::1]:323           [::]:*    users:(("chronyd",pid=34736,fd=6))
tcp   LISTEN 0      1024                  0.0.0.0:995        0.0.0.0:*    users:(("dovecot",pid=170029,fd=55))
tcp   LISTEN 0      1024                  0.0.0.0:993        0.0.0.0:*    users:(("imap-login",pid=185730,fd=11),("dovecot",pid=170029,fd=49))
tcp   LISTEN 0      100                   0.0.0.0:465        0.0.0.0:*    users:(("master",pid=169985,fd=99))
tcp   LISTEN 0      1024                  0.0.0.0:143        0.0.0.0:*    users:(("imap-login",pid=185730,fd=9),("dovecot",pid=170029,fd=47))
tcp   LISTEN 0      1024                  0.0.0.0:110        0.0.0.0:*    users:(("dovecot",pid=170029,fd=53))
tcp   LISTEN 0      128                   0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=32279,fd=7))
tcp   LISTEN 0      100                   0.0.0.0:25         0.0.0.0:*    users:(("master",pid=169985,fd=13))
tcp   LISTEN 0      10                  127.0.0.1:32799      0.0.0.0:*    users:(("chrome",pid=1622,fd=84))
tcp   LISTEN 0      4096                127.0.0.1:32768      0.0.0.0:*    users:(("docker-proxy",pid=185302,fd=8))
tcp   LISTEN 0      100                   0.0.0.0:4190       0.0.0.0:*    users:(("dovecot",pid=170029,fd=30))
tcp   LISTEN 0      511                   0.0.0.0:8880       0.0.0.0:*    users:(("sw-cp-serverd",pid=180408,fd=8),("sw-cp-serverd",pid=117190,fd=8))
tcp   LISTEN 0      511                   0.0.0.0:8443       0.0.0.0:*    users:(("sw-cp-serverd",pid=180408,fd=7),("sw-cp-serverd",pid=117190,fd=7))
tcp   LISTEN 0      511             my-ipv4:443        0.0.0.0:*    users:(("nginx",pid=178426,fd=84),("nginx",pid=178425,fd=84))
tcp   LISTEN 0      511             my-ipv4:80         0.0.0.0:*    users:(("nginx",pid=178426,fd=86),("nginx",pid=178425,fd=86))
tcp   LISTEN 0      4096                127.0.0.1:3030       0.0.0.0:*    users:(("grafana",pid=1795,fd=36))
tcp   LISTEN 0      100                 127.0.0.1:12346      0.0.0.0:*    users:(("master",pid=169985,fd=87))
tcp   LISTEN 0      4096                127.0.0.1:12768      0.0.0.0:*    users:(("psa-pc-remote",pid=170068,fd=3))
tcp   LISTEN 0      511                 127.0.0.1:8423       0.0.0.0:*    users:(("node",pid=1784,fd=22))
tcp   LISTEN 0      511                 127.0.0.1:8424       0.0.0.0:*    users:(("MainThread",pid=1309,fd=18))
tcp   LISTEN 0      1024                     [::]:995           [::]:*    users:(("dovecot",pid=170029,fd=56))
tcp   LISTEN 0      1024                     [::]:993           [::]:*    users:(("imap-login",pid=185730,fd=12),("dovecot",pid=170029,fd=50))
tcp   LISTEN 0      100                      [::]:465           [::]:*    users:(("master",pid=169985,fd=100))
tcp   LISTEN 0      1024                     [::]:143           [::]:*    users:(("imap-login",pid=185730,fd=10),("dovecot",pid=170029,fd=48))
tcp   LISTEN 0      1024                     [::]:110           [::]:*    users:(("dovecot",pid=170029,fd=54))
tcp   LISTEN 0      128                      [::]:22            [::]:*    users:(("sshd",pid=32279,fd=8))
tcp   LISTEN 0      100                      [::]:25            [::]:*    users:(("master",pid=169985,fd=14))
tcp   LISTEN 0      511                         *:7081             *:*    users:(("httpd",pid=179366,fd=6),("httpd",pid=177075,fd=6),("httpd",pid=177061,fd=6),("httpd",pid=177060,fd=6),("httpd",pid=177058,fd=6),("httpd",pid=177056,fd=6))
tcp   LISTEN 0      511                         *:7080             *:*    users:(("httpd",pid=179366,fd=4),("httpd",pid=177075,fd=4),("httpd",pid=177061,fd=4),("httpd",pid=177060,fd=4),("httpd",pid=177058,fd=4),("httpd",pid=177056,fd=4))
tcp   LISTEN 0      100                      [::]:4190          [::]:*    users:(("dovecot",pid=170029,fd=31))
tcp   LISTEN 0      511                      [::]:8880          [::]:*    users:(("sw-cp-serverd",pid=180408,fd=10),("sw-cp-serverd",pid=117190,fd=10))
tcp   LISTEN 0      511                      [::]:8443          [::]:*    users:(("sw-cp-serverd",pid=180408,fd=9),("sw-cp-serverd",pid=117190,fd=9))
tcp   LISTEN 0      511    [my-ipv6]:80            [::]:*    users:(("nginx",pid=178426,fd=87),("nginx",pid=178425,fd=87))
tcp   LISTEN 0      511    [my-ipv6]:443           [::]:*    users:(("nginx",pid=178426,fd=85),("nginx",pid=178425,fd=85))

@Sebahat.hadzhi I got errors like:

# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-08-07 10:56:32 CEST; 4s ago
       Docs: man:firewalld(1)
   Main PID: 181404 (firewalld)
      Tasks: 2 (limit: 819644)
     Memory: 28.8M (peak: 29.5M)
        CPU: 269ms
     CGroup: /system.slice/firewalld.service
             └─181404 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid


Aug 07 10:56:32 web1.xxx systemd[1]: Starting firewalld - dynamic firewall daemon...
Aug 07 10:56:32 web1.xxx firewalld[181404]: ERROR: Failed to load user configuration. Falling back to full stock configuration.
Aug 07 10:56:32 web1.xxx firewalld[181404]: ERROR: INVALID_IPSET: blocked_country_cn_ipv4
Aug 07 10:56:32 web1.xxx systemd[1]: Started firewalld - dynamic firewall daemon.
Aug 07 10:56:32 web1.xxx firewalld[181404]: ERROR: INVALID_ZONE: plesk


# firewall-cmd --reload
Error: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: No such file or directory
internal:0:0-0: Error: No such file or directory

So I changed /etc/firefwalld/firewalld.conf
DefaultZone=plesk
to
DefaultZone=public

and
FirewallBackend=iptables
to
FirewallBackend=nftables

# cat /etc/firewalld/zones/plesk.xml

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Plesk</short>
  <description>For use with Plesk.</description>
  <port port="22" protocol="tcp"/>
  <port port="21" protocol="tcp"/>
  <port port="25" protocol="tcp"/>
  <port port="53" protocol="tcp"/>
  <port port="53" protocol="udp"/>
  <port port="80" protocol="tcp"/>
  <port port="110" protocol="tcp"/>
  <port port="143" protocol="tcp"/>
  <port port="443" protocol="tcp"/>
  <port port="465" protocol="tcp"/>
  <port port="587" protocol="tcp"/>
  <port port="993" protocol="tcp"/>
  <port port="995" protocol="tcp"/>
  <port port="8443" protocol="tcp"/>
  <port port="8447" protocol="tcp"/>
  <port port="8880" protocol="tcp"/>
  <port port="49152-65535" protocol="tcp"/>
</zone>

# cat /etc/firewalld/zones/drop.xml

<?xml version="1.0" encoding="utf-8"?>
<zone target="DROP">
  <short>Drop</short>
  <description>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoi                                                                                      ng network connections are allowed.</description>
  <source ipset="blocked_country_cn_ipv4"/>
  <source ipset="blocked_country_cn_ipv6"/>
  <source ipset="blocked_country_ru_ipv4"/>
  <source ipset="blocked_country_ru_ipv6"/>
  <source ipset="blocked_country_ua_ipv4"/>
  <source ipset="blocked_country_ua_ipv6"/>
  <source ipset="blocked_country_kr_ipv4"/>
  <source ipset="blocked_country_kr_ipv6"/>
</zone>

Final step

# cp /etc/firewalld/zones/drop.xml /root/drop.xml.backup
# sed -i '/source ipset="blocked_country_/d' /etc/firewalld/zones/drop.xml
# systemctl restart firewalld
# firewall-cmd --reload
success
# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-08-07 11:01:36 CEST; 18s ago
       Docs: man:firewalld(1)
   Main PID: 181736 (firewalld)
      Tasks: 4 (limit: 819644)
     Memory: 31.5M (peak: 32.1M)
        CPU: 434ms
     CGroup: /system.slice/firewalld.service
             └─181736 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid

Aug 07 11:01:36 web1.xxx systemd[1]: Starting firewalld - dynamic firewall daemon...
Aug 07 11:01:36 web1.xxx systemd[1]: Started firewalld - dynamic firewall daemon.

 

[Azurel]

I noticed that Fail2Ban wasn't enabled after the reinstallation, possibly due to the firewall issue.

# systemctl status fail2ban
○ fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; disabled; preset: disabled)
Drop-In: /usr/lib/systemd/system/fail2ban.service.d
└─50-ensure-log.conf
Active: inactive (dead)

# systemctl enable fail2ban
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /usr/lib/systemd/system/fail2ban.service.

Are there any other settings or services I should check as well?