Re: [RH List] Re: Possible break-in

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Manuel Nauta wrote:

Just curious, was this server behind a firewall? If so, what
kind and what ports were open?

Open ports are:

   PORT     STATE SERVICE
   22/tcp   open  ssh
   25/tcp   open  smtp
   80/tcp   open  http
   111/tcp  open  rpcbind
   587/tcp  open  submission
   3306/tcp open  mysql


Looking at the sizes of some of these binaries, they've all grown:


Original (from RPM) Modified
-----------------------------------------------------------------------------
/usr/bin/gs 3,196,892 /usr/bin/gs 3,206,552
/usr/bin/pngtopnm 15,008 /usr/bin/pngtopnm 17,420
/usr/bin/pnmtopng 25,120 /usr/bin/pnmtopng 27,920
/usr/bin/pnmalias 8,620 /usr/bin/pnmalias 10,420


/sbin/ip 97,468 /sbin/ip 101,452
/sbin/rtmon 18,044 /sbin/rtmon 19,504
/sbin/tc 116,604 /sbin/tc 122,064


/usr/lib/libcupsimage.so.2 73,892 /usr/lib/libcupsimage.so.2 75,348
/usr/lib/libpng12.so.0.1.2.2 142,572 /usr/lib/libpng12.so.0.1.2.2 143,928


--
W | I haven't lost my mind; it's backed up on tape somewhere.
 +--------------------------------------------------------------------
 Ashley M. Kirchner <mailto:ashley@xxxxxxxxxx>   .   303.442.6410 x130
 IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
 Photo Craft Laboratories, Inc.            .     3550 Arapahoe Ave. #6
 http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A.




-- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list

[Index of Archives]     [CentOS]     [Kernel Development]     [PAM]     [Fedora Users]     [Red Hat Development]     [Big List of Linux Books]     [Linux Admin]     [Gimp]     [Asterisk PBX]     [Yosemite News]     [Red Hat Crash Utility]


  Powered by Linux