« Return to Thread: Are these scan logs dangerous ?

Re: Are these scan logs dangerous ?

by Brian Bilbrey :: Rate this Message:

Reply to Author | View in Thread


On Jul 5, 2009, at 3:26 PM, a dehqan wrote:
...
>
>
> But about ident service ,see >
>
> # chkconfig --level 23 identd off
> identd: unknown service
>
> But port 113 auth is open ! So which service has opened port 113 ?


Remember your initial warning messages from rhunter:

 >>> [11:19:59]   Checking for enabled inetd services              
[ Warning ]
 >>> [11:19:59] Warning: Found enabled inetd service: ident

So, inetd superserver is probably where you want to look. Either  
inetd.conf or xinetd.conf or xinetd.d/* ...

But remember, there are legitimate reasons to be running ident.

best,


.brian

--
Brian Bilbrey : bilbrey@...
"Regulatory science is to science as bear traps are to bears."
                                 Dr. Jerry Pournelle


--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

 « Return to Thread: Are these scan logs dangerous ?