TCP port 603 open
 

I ran a portscan on myself and it seems I have TCP port 603 open. I've tried finding out any services running on this port by checking /etc/services and searching the web, but I can't find anything. I don't think it was open before, do you think something's wrong?

Hard to say without knowing more. Try using netstat -pantu or lsof -i to see what application/process is utilizing that port.

Here is the line from netstat -pantu:

And lsof -i:

I can't make out anything from it... Can you?

The netstat output doesn't really tell us much, but lsof -i does. First, it tells us that the port is being opened by inetd. Inetd acts as kind of like a intermediate server, where a given service is run through the inetd server. So instead of having a individual daemon listening at that port for connections, inetd will do the listening and then when that specific service is required it will pass the connection off to the specific daemon (hence the nickname "Inetd superServer"). That way you don't need to have multiple daemons listening at the same time and wasting resources.

Now, go to the /etc/inted.conf file and look for any uncommented services that either specifically list port 603 or that aren't readily apparent as to what they do.

Also are you running any kind of intrusion detection software? TCP port 603 is reserved for IDXP or Intrusion Detection Exchange protocol, which is used by various IDS applications to communicate with each other or with something like a central logging server. However, just because a certain port number is normally used by a service or protocol doesn't guarantee that's what is actually running.

I don't have any kind of IDS software running. I checked my inetd.conf file and found this line uncommented at the end:

I commented it and now the port is closed.

It's called the File Alteration Monitor. Here is the URL. On the site:

I'm guessing some program installed it, as I had previously commented out every line in my inetd.conf. Do you have any idea of what program might have put it there?

The only things I can think of that use sgi_fam are some of the GUI file managers (like Nautilus) and NFS/RPC stuff. Normally I would say when you think something had been modified, immediately use the stat command to see if you can determine the last modification time/date. Since you've already modified it, that won't do much good now though.

SGI_FAM is a pretty common thing with most distros and is turned on by default in many of them. If you are paranoid about it, you can get an md5sum of the famd binary and compare that to a known good version.

I recently installed dropline-gnome under Slackware, I have a feeling that installed it.

Thanks for all the help.