Are you sure it's Sentinel that opened that port?  That's not a default Sentinel port:

https://www.microfocus.com/documentation/sentinel/8.6/s861-install/b1229xum.html

What process opened the port? (netstat -patune | grep 9080).

Regards

Crof

Hi Crof 

     customer has some sentinel appliance ...one appliance which upgrade from 8.5.0 ...like you provide...

but these senitnel appliances are upgrade previous version (sorry...I forfor the initial version is 8.2 or 8.0) , they indeed open 9080 as screenshot (the service is httpd_prefork)

this is my lab server...it indeed open 9080 like customer's appliance.

Wencheng

Ah ok, it's an appliance.  As a test, I just installed a brand new 8.6.1 appliance and while it has the vhost config, it doesn't have the port open.  So, I suspect it might just be a hangover from a previous version of the appliance.  I would try just blocking the port in the firewall.

Customer use Vulnerability scan tool (Nessus) in local LAN...so no other firewall could block.

I check /etc/sysconfig/SuSEfirewall2.d/services , they seem no open 9080....But I still could telnet 9080 from other device.

Wencheng

You can reject the port using the main SuSEfirewall2 config:

Edit /etc/sysconfig/SuSEfirewall2 and look for "FW_SERVICES_REJECT_EXT=".  You can add port 9080 in there e.g.

FW_SERVICES_REJECT_EXT=”0/0,tcp,9080”

Save the file and restart SuSEfirewall2.

Note - In my fresh install of the 8.6.1 appliance, this setting is there by default.

HI Crof 

     one question: If I move the vhost-vabase.conf then restart apache2 service...(let TCP9080 could not listen)

Which function will it affect??

Thanks!!

Wencheng

I'm afraid I don't know what messing with the vhost will affect, possibly nothing.  Better option is to block the port as I suggested, since that now appears to be the default.

FYI - In a completely new install of the 8.6.1 appliance the vhost config is in place, port 9080 is blocked, and the httpd-prefork service is not running.