LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-16-2013, 08:26 AM   #1
thund3rstruck
Member
 
Registered: Nov 2005
Location: East Coast, USA
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 346

Rep: Reputation: 38
Machine is FTPing into Walla Walla University.


Came in this morning and noticed a connection to
Code:
192.147.172.161:21
So I fired up the terminal and tried to manually connect to this address:

Code:
[nealosis@LISAXPS410FEDORA ~]$ ftp 192.147.172.161
Connected to 192.147.172.161 (192.147.172.161).
220-
220-+---------------------------------------------------------+
220-|    Welcome to the Walla Walla University FTP server     |
220-|                                                         |
220-|   Please send suggestions/questions/comments/etc. to    |
220-|                ftprequest@wallawalla.edu                |
220-|                                                         |
220-| Please see /FAQ for questions regarding this FTP server |
220-+---------------------------------------------------------+
220 
Name (192.147.172.161:lisa): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
I was able to log in as anonymous and look around. Looks like these are linux update packages on this server and if that's so then I guess its ok.

Is it standard practice for Linux workstations to establish anonymous FTP connections behind the scenes like this?
 
Old 04-16-2013, 08:30 AM   #2
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.5, Centos 5.10
Posts: 16,264

Rep: Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028
Not without a good reason. You need to backtrack and see who is running that cxn (netstat, ps etc).
lsof http://linux.die.net/man/8/lsof can check that too.
See also fuser http://linux.die.net/man/1/fuser

Last edited by chrism01; 04-16-2013 at 08:31 AM.
 
Old 04-16-2013, 08:56 AM   #3
thund3rstruck
Member
 
Registered: Nov 2005
Location: East Coast, USA
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 346

Original Poster
Rep: Reputation: 38
Quote:
Originally Posted by chrism01 View Post
Not without a good reason. You need to backtrack and see who is running that cxn (netstat, ps etc).
lsof http://linux.die.net/man/8/lsof can check that too.
See also fuser http://linux.die.net/man/1/fuser
Yea, I only noticed this because my conky displays netstat output. The connection is long gone now but the next time I see it I'll want to lsof it.

Thanks!
 
Old 04-16-2013, 08:05 PM   #4
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.5, Centos 5.10
Posts: 16,264

Rep: Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028
Is it using that Uni as a repo for auto updates?
If its using a mirrorlist, you may have to do some digging to check.
 
Old 04-25-2013, 09:33 AM   #5
thund3rstruck
Member
 
Registered: Nov 2005
Location: East Coast, USA
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 346

Original Poster
Rep: Reputation: 38
Quote:
Originally Posted by chrism01 View Post
Is it using that Uni as a repo for auto updates?
If its using a mirrorlist, you may have to do some digging to check.
It took a few days but this morning this Fedora machine is again establishing FTP connections behind my back to WallaWalla university. lsof reports nothing at all.

Code:
netstat -t | grep -i 21
tcp        0      0 LISAXPS410FEDORA:53421  fry.wallawalla.edu:ftp  ESTABLISHED
Code:
lsof -i tcp:21
# no output
Maybe the connection was dropped before the lsof? --run netstat again

Code:
netstat -tn | grep -i 21
tcp        0      0 192.168.2.109:39879     98.124.49.250:21        ESTABLISHED
tcp        0      0 192.168.2.109:53421     192.147.172.161:21      ESTABLISHED
tcp        0      0 192.168.2.109:44583     140.211.166.134:21      ESTABLISHED
Not sure what to do now. How do I track down what process is making these ftp connections? Even if this connection is legit, I'm not comfortable with any process making anonymous connections to remote servers without rendering a dialog or something to indicate that what's going on is legit.
 
Old 04-25-2013, 09:43 AM   #6
thund3rstruck
Member
 
Registered: Nov 2005
Location: East Coast, USA
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 346

Original Poster
Rep: Reputation: 38
Ugh... lsof will run but not produce output if not running as root...

Code:
su -c 'lsof -i :21'

COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
yumBacken 17290 root   18u  IPv4  47399      0t0  TCP LISAXPS410FEDORA:39879->mirror.nexicom.net:ftp (CLOSE_WAIT)
yumBacken 17290 root   22u  IPv4  47445      0t0  TCP LISAXPS410FEDORA:44583->ftp-osl.osuosl.org:ftp (CLOSE_WAIT)
yumBacken 17290 root   23u  IPv4  47452      0t0  TCP LISAXPS410FEDORA:53421->fry.wallawalla.edu:ftp (ESTABLISHED)
Ok, so it looks like this is some yum process backend. I wonder if there is a setting where I can diable this phone-home action? If I want to update yum then I use 'yum update'; I don't need (or want) it phoning home on its own.
 
Old 04-25-2013, 08:35 PM   #7
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.5, Centos 5.10
Posts: 16,264

Rep: Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028Reputation: 2028
As I suspected
Thought I vaguely recognised the Uni

As its Fedora, why not head on over to the Fedora Project homesite and check/ask?
In fact here you go https://fedoraproject.org/wiki/AutoUpdates.
Enjoy
 
1 members found this post helpful.
Old 04-25-2013, 09:20 PM   #8
thund3rstruck
Member
 
Registered: Nov 2005
Location: East Coast, USA
Distribution: Fedora 18, Slackware64 13.37, Windows 7/8
Posts: 346

Original Poster
Rep: Reputation: 38
Quote:
Originally Posted by chrism01 View Post
As I suspected
Thought I vaguely recognised the Uni

As its Fedora, why not head on over to the Fedora Project homesite and check/ask?
In fact here you go https://fedoraproject.org/wiki/AutoUpdates.
Enjoy
Wow.. thank you! That link exactly explains what's going on and why!

I'm only a passing Fedora user (spend most of my time in Slackware and SLED) and I sincerely appreciate your assistance!
 
  


Reply

Tags
ftp, services


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Epiphany and Walla.com e-mail sending moshebagelfresser Linux - Software 5 01-20-2009 03:25 PM
Need help FTPing and Moving files. Xanith Programming 6 05-04-2004 09:59 AM
Will FTPing a .gz to Win2K ruin it? ronald_fancher Linux - General 1 07-14-2002 09:38 PM
FTPing Rubicone Linux - Newbie 0 04-22-2002 09:12 PM
FTPing george3k Linux - General 4 07-25-2001 08:29 AM


All times are GMT -5. The time now is 10:29 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration