[SOLVED] Machine is FTPing into Walla Walla University.

thund3rstruck · 04-16-2013, 08:26 AM

Came in this morning and noticed a connection to

Code:

192.147.172.161:21

So I fired up the terminal and tried to manually connect to this address:

Code:

[nealosis@LISAXPS410FEDORA ~]$ ftp 192.147.172.161
Connected to 192.147.172.161 (192.147.172.161).
220-
220-+---------------------------------------------------------+
220-|    Welcome to the Walla Walla University FTP server     |
220-|                                                         |
220-|   Please send suggestions/questions/comments/etc. to    |
220-|                ftprequest@wallawalla.edu                |
220-|                                                         |
220-| Please see /FAQ for questions regarding this FTP server |
220-+---------------------------------------------------------+
220 
Name (192.147.172.161:lisa): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

I was able to log in as anonymous and look around. Looks like these are linux update packages on this server and if that's so then I guess its ok.

Is it standard practice for Linux workstations to establish anonymous FTP connections behind the scenes like this?

chrism01 · 04-16-2013, 08:30 AM

Not without a good reason. You need to backtrack and see who is running that cxn (netstat, ps etc).
lsof http://linux.die.net/man/8/lsof can check that too.
See also fuser http://linux.die.net/man/1/fuser

thund3rstruck · 04-16-2013, 08:56 AM

Quote:

Originally Posted by chrism01

Not without a good reason. You need to backtrack and see who is running that cxn (netstat, ps etc).
lsof http://linux.die.net/man/8/lsof can check that too.
See also fuser http://linux.die.net/man/1/fuser

Yea, I only noticed this because my conky displays netstat output. The connection is long gone now but the next time I see it I'll want to lsof it.

Thanks!

chrism01 · 04-16-2013, 08:05 PM

Is it using that Uni as a repo for auto updates?
If its using a mirrorlist, you may have to do some digging to check.

thund3rstruck · 04-25-2013, 09:33 AM

Quote:

Originally Posted by chrism01

Is it using that Uni as a repo for auto updates?
If its using a mirrorlist, you may have to do some digging to check.

It took a few days but this morning this Fedora machine is again establishing FTP connections behind my back to WallaWalla university. lsof reports nothing at all.

Code:

netstat -t | grep -i 21
tcp        0      0 LISAXPS410FEDORA:53421  fry.wallawalla.edu:ftp  ESTABLISHED

Code:

lsof -i tcp:21
# no output

Maybe the connection was dropped before the lsof? --run netstat again

Code:

netstat -tn | grep -i 21
tcp        0      0 192.168.2.109:39879     98.124.49.250:21        ESTABLISHED
tcp        0      0 192.168.2.109:53421     192.147.172.161:21      ESTABLISHED
tcp        0      0 192.168.2.109:44583     140.211.166.134:21      ESTABLISHED

Not sure what to do now. How do I track down what process is making these ftp connections? Even if this connection is legit, I'm not comfortable with any process making anonymous connections to remote servers without rendering a dialog or something to indicate that what's going on is legit.

thund3rstruck · 04-25-2013, 09:43 AM

Ugh... lsof will run but not produce output if not running as root...

Code:

su -c 'lsof -i :21'

COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
yumBacken 17290 root   18u  IPv4  47399      0t0  TCP LISAXPS410FEDORA:39879->mirror.nexicom.net:ftp (CLOSE_WAIT)
yumBacken 17290 root   22u  IPv4  47445      0t0  TCP LISAXPS410FEDORA:44583->ftp-osl.osuosl.org:ftp (CLOSE_WAIT)
yumBacken 17290 root   23u  IPv4  47452      0t0  TCP LISAXPS410FEDORA:53421->fry.wallawalla.edu:ftp (ESTABLISHED)

Ok, so it looks like this is some yum process backend. I wonder if there is a setting where I can diable this phone-home action? If I want to update yum then I use 'yum update'; I don't need (or want) it phoning home on its own.

chrism01 · 04-25-2013, 08:35 PM

As I suspected

Thought I vaguely recognised the Uni

As its Fedora, why not head on over to the Fedora Project homesite and check/ask?
In fact here you go https://fedoraproject.org/wiki/AutoUpdates.
Enjoy

thund3rstruck · 04-25-2013, 09:20 PM

Quote:

Originally Posted by chrism01

As I suspected

Thought I vaguely recognised the Uni

As its Fedora, why not head on over to the Fedora Project homesite and check/ask?
In fact here you go https://fedoraproject.org/wiki/AutoUpdates.
Enjoy

Wow.. thank you! That link exactly explains what's going on and why!

I'm only a passing Fedora user (spend most of my time in Slackware and SLED) and I sincerely appreciate your assistance!