ip a, ss -tlnp, and the ports nobody documented

A host that has been running for four years is listening on things nobody remembers configuring, and the audit is two commands.

$ ss -tlnp
State  Local Address:Port   Process
LISTEN 0.0.0.0:22          sshd
LISTEN 0.0.0.0:80          nginx
LISTEN 0.0.0.0:443         nginx
LISTEN 0.0.0.0:9200        java          ← elasticsearch, public
LISTEN 127.0.0.1:6379      redis-server
LISTEN 0.0.0.0:3306        mysqld        ← also public

# 0.0.0.0 on 9200 and 3306 is the finding. the firewall
# was the only thing preventing it.

Binding to 0.0.0.0 and relying on a firewall is one layer where there should be two, and it is the arrangement that fails when a firewall rule is edited by somebody solving a different problem. Binding services to 127.0.0.1 or to a private interface costs nothing and means a firewall mistake is not an exposure.