Only Port 111?

Computing.Net > Forums > Security and Virus > Only Port 111?

Original Message

Name: codemaster
Date: August 2, 2008 at 13:35:47 Pacific
Subject: Only Port 111?
OS: Ubuntu 8.04
CPU/Ram: AMD 64 3000+, 1024 D
Model/Manufacturer: Quantum Raiders

Comment:

Oddly enough, my Ubuntu server (I only have SSH access) was working fine last night. This morning, I was unable to connect to the server, so I ran nmap to see what was running - it seems only port 111 (rpcbind) was open.
Any idea how this happened and how I can regain access to this machine?
Thanks for any help
"Everything begins with Nu and everything ends with Nu. This is the truth! This is my belief... at least for now." - Mysteries of Life Volume 184 Chapter 26

Report Offensive Message For Removal

Response Number 1

Name: guapo
Date: August 2, 2008 at 19:22:51 Pacific

Reply: (edit)

My guess is that sshd stopped running and has to be restarted. Run man sshd to learn how to restart it.

Report Offensive Follow Up For Removal

Response Number 2

Name: codemaster
Date: August 2, 2008 at 20:04:38 Pacific

Reply: (edit)

The oddity is that there were numerous services on the machine and all of them stopped (presumably).
Is there any other way, you think, I could get into the machine (except manually, of course)?
"Everything begins with Nu and everything ends with Nu. This is the truth! This is my belief... at least for now." - Mysteries of Life Volume 184 Chapter 26

Report Offensive Follow Up For Removal

Response Number 3

Name: guapo
Date: August 2, 2008 at 20:20:51 Pacific

Reply: (edit)

I don't see how you can have remote access with only that port opened. There was a port mapper exploit some years ago but I'm sure that's patched by now.
I use FreeBSD, so I'm not familiar with Ubuntu. If it happened to me on FreeBSD, I would be looking at /etc/inetd.conf which is where those services start.

Report Offensive Follow Up For Removal

Response Number 4

Name: codemaster
Date: August 2, 2008 at 20:51:42 Pacific

Reply: (edit)

Thanks for your help. I am guessing the server just had a hiccup and needs to be restarted. I'll have to do this in a few weeks when I have physical access to the box.
"Everything begins with Nu and everything ends with Nu. This is the truth! This is my belief... at least for now." - Mysteries of Life Volume 184 Chapter 26

Report Offensive Follow Up For Removal


How do you close an infected port? Port 1025 IP Filter Based Firewalls HOWTO Importance of firewall & anti-virus Linksys router problem?	virus alert!!!!! Very High amount of hacks 9-25-03 Firewall Blocks on this Chat Site How to close ports!!! Wiping the Hard Drive CLEAN!!??

System was hijacked

compaq nc6000

Use following form to reply to current message:

Name: From My Computing.Net Settings E-Mail: From My Computing.Net Settings Subject: Only Port 111?

Comments:

  Homepage URL (*): 
Homepage Title (*): 
         Image URL:

Have you ever used OpenOffice?

Poll Finishes In 5 Days.
Discuss in The Lounge

Error 0701: USB Over Current On

Booting from disk isn't working

Dos on disk-on-module

IE & Firefox showing old website

Delgated authentication

All Posts Awaiting Replies