|
Title: Extrange process, what to do next Post by: celord on December 02, 2009, 01:41:31 PM Hello guys, I've found that a Fedora Core 5 server Kernel 2.6.15-1.2054_FC5, is doing port scans, and we hace received complains about that, the extrange connection that I've found is this one:
Netstat Oupput: Code: tcp 0 65 192.168.200.8:45436 194.109.20.90:6669 ESTABLISHED 1925/bash Everytime that I kill the procc, it gets connected again in 30 secs, so I've don this: IPTABLES ACTION: 2. I've done this on the server as a countermeasure Code: iptables -A OUTPUT -d 194.109.20.0/24 -j DROP Thanks a lot for your advices Title: Re: Extrange process, what to do next Post by: Ketchup on December 02, 2009, 03:43:12 PM This port has some associations with known remote control utilities. What does netstat -antp tell the process using this port is? In short, it looks like your box may have gotten owned. Any chance you can decommission it and reinstall the OS?
Title: Re: Extrange process, what to do next Post by: 3PIL0GU3 on December 02, 2009, 05:31:28 PM Have you got a hardware based firewall or an IDS ie. Snort installed
Title: Re: Extrange process, what to do next Post by: celord on December 03, 2009, 07:11:55 AM Nop, nothing new installed
Powered by SMF 1.1.18 |
SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com |