TCP Port 814 Identity

carstenson · 02-17-2009, 09:01 AM

I have a fairly recent install of Arch 2008.06. I ran nmap on it and found that I have port 814 available to the world. I can't find any documentation on this. Is there a way for me to tell what program is issuing a listen for this?

ilikejam · 02-17-2009, 09:28 AM

Hi.

Try 'netstat -pantu | grep LIST | grep 814' as root.

Dave

carstenson · 02-17-2009, 10:07 AM

Thanks, Jam. I checked out netstat, but should have looked at the swithes in man.

Now I need to learn more about famd. This was a package that I installed due to some log errors and I should have known more about it before installing.

Code:

[root@carstenson ~]# netstat -pantu | grep LIST | grep 814
tcp        0      0 0.0.0.0:814             0.0.0.0:*               LISTEN 1486/famd
[root@carstenson ~]# ps -ef|fgrep famd
root      1486     1  0 Feb15 ?        00:00:00 /usr/sbin/famd -T 0 -c /etc/fam/fam.conf

carstenson · 02-17-2009, 10:32 AM

Looks like the fam package is used by my courier-imap. Somebody decided that the the Arch package should install with the local_only changed from its default.

I changed this from "false" to "true" and port 814 is no longer bound to my outside address. I'll send a follow-up, if this causes any problems, but I can't imagine why this needs to be available to remote clients.

Code:

#
#  local_only makes famd ignore requests from remote clients & remote fams.
#  Note that this is ignored if famd is started by inetd.
#
#  The -L command-line argument overrides this option.
#
local_only = true

ilikejam · 02-17-2009, 10:50 AM

Hi again.

famd listening for external requests is for file monitoring over NFS - instead of polling the NFS system for changes to files, a client's famd can just ask the server's famd to notify it if there's any changes.

So unless you're exporting NFS filesystems, I think you're OK to switch it to local_only.

Dave