If you have a particular proggy that does that stuff like port listening,
etc.. I'd start there.. actually I'd start in /etc/inetd.conf and see what
is uncommented that you don't actually use. Sometimes system
crackers/hackers (crack to break in, hack to alter settings) add stuff to
that file to give themselves an unsecured backdoor. Always good to look
around in the file every-so-often to make sure everything is in working
order.
I always like to keep an eye on "ps aux" and "netstat -a" output.. making
sure that CPU usage times are where they should be and that network
traffic looks good :P
On Sun, 15 Oct 2000, Chris Harvey wrote:
> Hey,
>
> > ircd = internet really chat daemon. if you don't know what ircd
> > is.. short answer: the reason for the existence of all of those "chat
> > room" things you hear about everywhere. It's been around for over 10
> > years. Check out BitchX or XChat. You actually have to download the code
> > for an ircd server and screw around with it (configuration, etc) for a
> > long time before it's very usable.. you don't have an ircd on your system
> > unless someone put it there.. netstat just shows addresses/ports.. so
> > something is running on port 6667 (ircd default port) which could be ircd
> > or something else that happened to get 6667 as an ephemeral port.
>
> Yeah I realized about 30 mins after hitting 'send' what it was.. I new it
> but couldn't recall it (I that's what 16 hours in front of your machine will
> do to you!).
>
> What I eventually found was that the ircd isn't running (and isn't
> installed). What appears to be happening is if you telnet into port 'ircd'
> you end up at the 'telnet' port. So I guess what I 'thought' I was reading
> in a netstat -a wasn't what I was really reading.
>
> So when you see this:
>
> tcp 0 0 *:ircd *:* LISTEN
>
> It doesn't actually mean something is sitting on the back of it I guess.
>
> So next question. How do you stop the system being in LISTEN mode on many of
> these other ports?? It seems to me I can add them add the my IPCHAINS DENY
> but why would they be in listen mode in the first place?
>
> Chris
>
>
>
> _______________________________________________
> Redhat-list mailing list
> [EMAIL PROTECTED]
> https://listman.redhat.com/mailman/listinfo/redhat-list
>
--
-Statux
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
