Editing 430.ch Reconnaissance Report (section)

=== High Priority ===

==== Close or restrict <code>5355/tcp</code> on <code>ov.430.ch</code> ====

Finding:

* <code>5355/tcp</code> is open on <code>83.228.241.25</code> and <code>2001:1600:18:102::26f</code>.
* Nmap labels it <code>llmnr</code>.

Why it matters:

* LLMNR is generally local-network-only functionality and should not be Internet-facing.
* If this is not LLMNR, an undocumented public service is still exposed.

Recommended action:

* Identify the listening process.
* If unintended, stop it and firewall <code>5355/tcp</code> and likely <code>5355/udp</code>.
* If intended, restrict source IPs and document it.

Example local triage commands on the server:

<pre>
ss -ltnup | grep ':5355'
systemctl status systemd-resolved
</pre>

==== Restrict IPv6 <code>8080/tcp</code> on <code>ov.430.ch</code> ====

Finding:

* <code>8080/tcp</code> is open on IPv6 but filtered on IPv4.
* It exposes Apache/PHP/MediaWiki directly.

Why it matters:

* If Caddy is intended as the public reverse proxy, direct backend access can bypass proxy-layer controls, logging assumptions, rate limits, or header normalization.
* IPv6 firewall parity often gets missed.

Recommended action:

* Bind Apache backend only to loopback if it is only used by Caddy.
* Otherwise firewall <code>8080/tcp</code> consistently on IPv4 and IPv6.

Example local triage:

<pre>
ss -ltnp | grep ':8080'
</pre>

==== Confirm <code>6567/tcp</code> and <code>6567/udp</code> ====

Finding:

* <code>6567/tcp</code> is open on <code>ov.430.ch</code>.
* <code>6567/udp</code> is <code>open|filtered</code>.
* Port 6567 is commonly used by Mindustry.

Recommended action:

* Confirm whether this is intentional.
* If it is a game server, consider whether it should be public and whether it needs rate limits or firewall restrictions.
* If unused, close it.