Hi! I just ran an "nmap -sT localhost" and saw the following port open: 1524/tcp open ingreslock Can somebody tell me, what this is? Up to now, the only Ports open were ssh@22 and X11@6000. Sorry for the stupid question, but I'm quite a newbie... Thanks, and have a nice evening. Greetings Markus
Markus Kohli schrieb am Montag den 05. Februar 2001:
I just ran an "nmap -sT localhost" and saw the following port open:
1524/tcp open ingreslock
Can somebody tell me, what this is?
lsof -i TCP:1524 Gruß Jens -- .. may the Tux be with you! #130250
Markus Kohli schrieb am Montag den 05. Februar 2001:
I just ran an "nmap -sT localhost" and saw the following port open:
1524/tcp open ingreslock
Can somebody tell me, what this is?
lsof -i TCP:1524
:-) fuser -n tcp 1524,, Or, easiest, use netstat -anp
Gruß Jens
Thanks,
Roman.
--
- -
| Roman Drahtmüller
Be careful with ingreslock , see http://www.cert.org/incident_notes/IN-99-04.html. kind regards Peter -----Ursprüngliche Nachricht----- Von: root@duba05h05-0.dplanet.ch [mailto:root@duba05h05-0.dplanet.ch]Im Auftrag von Markus Kohli Gesendet: Montag, 5. Februar 2001 18:26 An: suse-security@suse.com Betreff: [suse-security] Open Port Hi! I just ran an "nmap -sT localhost" and saw the following port open: 1524/tcp open ingreslock Can somebody tell me, what this is? Up to now, the only Ports open were ssh@22 and X11@6000. Sorry for the stupid question, but I'm quite a newbie... Thanks, and have a nice evening. Greetings Markus --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Yup, ingreslock is the standard port that several backdoors use.. At 05:20 PM 6/02/2001, you wrote:
Be careful with ingreslock ,
see http://www.cert.org/incident_notes/IN-99-04.html.
kind regards Peter
-----Ursprüngliche Nachricht----- Von: root@duba05h05-0.dplanet.ch [mailto:root@duba05h05-0.dplanet.ch]Im Auftrag von Markus Kohli Gesendet: Montag, 5. Februar 2001 18:26 An: suse-security@suse.com Betreff: [suse-security] Open Port
Hi!
I just ran an "nmap -sT localhost" and saw the following port open:
1524/tcp open ingreslock
Can somebody tell me, what this is?
Up to now, the only Ports open were ssh@22 and X11@6000.
Sorry for the stupid question, but I'm quite a newbie... Thanks, and have a nice evening.
Greetings
Markus
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--- Nix - nix@susesecurity.com http://www.susesecurity.com
Peter Bethke wrote:
Be careful with ingreslock ,
see http://www.cert.org/incident_notes/IN-99-04.html.
kind regards Peter
I just installed pmfirewall. I let it block all ports, but the problem is, I don't get a connection to the internet, afterwards. Does anybody know that program by heart and can give me some advice on how to configure that stuff? thanks mfg markus
Peter Bethke wrote:
Be careful with ingreslock ,
see http://www.cert.org/incident_notes/IN-99-04.html.
kind regards Peter
I just installed pmfirewall. I let it block all ports, but the problem is, I don't get a connection to the internet, afterwards. Does anybody know that program by heart and can give me some advice on how to configure that stuff?
i have a Firewall-Script for RedHat, which should be not that hard to adapt to SuSE. I can mail it to you if you want... Jan
participants (6)
-
Jan Räther -
Jens Tautenhahn -
Markus Kohli -
Nix -
Peter Bethke -
Roman Drahtmueller