| 1 |
>>>> If the machine is running linux, then 'watch "lsof -n|grep TCP|grep |
| 2 |
>>>> 3680"' as root is a sloppy but effective way to find it. There's |
| 3 |
>>>> probably some way to set up a firewall rule on the host in question |
| 4 |
>>>> that logs out the user and (possibly) PID of the connection, but I |
| 5 |
>>>> don't know. |
| 6 |
>>> |
| 7 |
>>> |
| 8 |
>>> "lsof -i" is easier, it only shows network connections :) |
| 9 |
>>> |
| 10 |
>>> catching it when it happens (if it is very briefly connected) could be |
| 11 |
>>> hard with lsof... Maybe setup a tarpit firewall rule on that box so |
| 12 |
>>> the connection stays open for a long time. |
| 13 |
>> |
| 14 |
>> |
| 15 |
>> The connections are only attempted a few times throughout the day. Is |
| 16 |
>> a tarpit firewall rule the only way to do this? Can anyone tell me |
| 17 |
>> what package 'watch' belongs to if that would work? |
| 18 |
>> |
| 19 |
> |
| 20 |
> `watch` isn't going to help too much unless you're looking at it. Append the |
| 21 |
> output to some log file instead. I chose netstat because its output looked |
| 22 |
> easier to parse with a stupid regexp. |
| 23 |
> |
| 24 |
> while true; do |
| 25 |
> netstat -antp | grep ':993 ' >> mystery.log; |
| 26 |
> sleep 1; |
| 27 |
> done; |
| 28 |
> |
| 29 |
> You'll want to change the port -- I tested to make sure that was really |
| 30 |
> logging my Thunderbird connections. |
| 31 |
|
| 32 |
I'm still getting the blocked outbound requests to port 3680 on my |
| 33 |
firewall and I'm running the above script (changed 993 to 3680) on the |
| 34 |
local system indicated by SRC in the firewall log, but mystery.log |
| 35 |
remains empty. I tested the script with other ports and it seems to |
| 36 |
be working fine. |
| 37 |
|
| 38 |
Also the MAC indicated in the firewall log is 14 blocks long and the |
| 39 |
local system in question has a MAC address 6 blocks long according to |
| 40 |
ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks |
| 41 |
reported by the firewall. |
| 42 |
|
| 43 |
Does this make sense to anyone? |
| 44 |
|
| 45 |
I installed and ran rkhunter and this was the only warning I couldn't disregard: |
| 46 |
|
| 47 |
Warning: The command '/usr/sbin/rkhunter' has been replaced and is not |
| 48 |
a script: /usr/sbin/rkhunter: POSIX shell script, ASCII text |
| 49 |
executable, with very long lines |
| 50 |
|
| 51 |
- Grant |
Archives