Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I ran a portscan on myself and it seems I have TCP port 603 open. I've tried finding out any services running on this port by checking /etc/services and searching the web, but I can't find anything. I don't think it was open before, do you think something's wrong?
The netstat output doesn't really tell us much, but lsof -i does. First, it tells us that the port is being opened by inetd. Inetd acts as kind of like a intermediate server, where a given service is run through the inetd server. So instead of having a individual daemon listening at that port for connections, inetd will do the listening and then when that specific service is required it will pass the connection off to the specific daemon (hence the nickname "Inetd superServer"). That way you don't need to have multiple daemons listening at the same time and wasting resources.
Now, go to the /etc/inted.conf file and look for any uncommented services that either specifically list port 603 or that aren't readily apparent as to what they do.
Also are you running any kind of intrusion detection software? TCP port 603 is reserved for IDXP or Intrusion Detection Exchange protocol, which is used by various IDS applications to communicate with each other or with something like a central logging server. However, just because a certain port number is normally used by a service or protocol doesn't guarantee that's what is actually running.
The only things I can think of that use sgi_fam are some of the GUI file managers (like Nautilus) and NFS/RPC stuff. Normally I would say when you think something had been modified, immediately use the stat command to see if you can determine the last modification time/date. Since you've already modified it, that won't do much good now though.
SGI_FAM is a pretty common thing with most distros and is turned on by default in many of them. If you are paranoid about it, you can get an md5sum of the famd binary and compare that to a known good version.