pnscan running but not installed Post: 302611731

Sponsored Content

Special Forums Cybersecurity pnscan running but not installed Post 302611731 by seanhogge on Friday 23rd of March 2012 11:23:07 AM

03-23-2012

Registered User

pnscan running but not installed

Hello to everyone. I have encountered my first security breach! Quite exciting.

I received a few polite emails from abuse networks indicating my outward-facing web & ftp (no mail) server was sending them unfriendly traffic. A quick htop showed that root had executed "pnscan" but I never recalled installing it. I sent it a kill -9, and sure enough, dpkg -s pnscan tells me it's never been installed.

So it seems pretty clear that someone's gotten access to my system in some fashion. The problem is, I don't know where to begin looking. I've scoured logs - I don't see anything obviously fishy there. I've checked bash history - nothing there (though that's easy to circumvent).

Where else should I be looking, or what has my inexperience caused me to miss in the logs? Is this definitely someone who's rooted my server? Could be an FTP vulnerability?

---------- Post updated at 09:23 AM ---------- Previous update was at 09:14 AM ----------

Oops. This should have been posted in Security. I won't repost, I'll let a moderator move it. Sorry for the inconvenience.

seanhogge

View Public Profile for seanhogge

Find all posts by seanhogge

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

How to prevent job1 from running while job2 is running..

Hi, Please I need your expert advise on how to prevent/lock from execution job1 while job2 is still running in Unix... THanks:)

2. UNIX for Dummies Questions & Answers

how to know if oracle is installed ?

can anyone please tell me how to know whether oracle is installed in unix? what is the path to check if oracle is installed or not?

3. Programming

No dbx installed

I have a problem whith dbx: there is no dbx installed!!! Could someone tell me where do i get dbx program and how to install it? Thanks.

4. Linux

Get the OS Installed date

Hi, How to get OS installed date in Linux using terminal command? Thanks is advance

5. UNIX for Advanced & Expert Users

Firewall installed

Hi Friends, I have installed Web App Server(WAS) on Linux box, but unable to launch webinterface from IE. I have a doubt that there is a firewall installed on the Linux box. How can I verify that there is no firewall installed on the machine where WAS is installed (Linux machine). ...

6. AIX

OS Patches installed but they seem as not installed

Hello everyone: I've installed an OS patch into AIX 6.1 by running the following command: instfix -d /tmp/6100-02-03 -k "IZ41855" however it seem not installed instfix -i -k "IZ41855" There was no data for IZ41855 in the fix database. what am I doing wrong?

7. AIX

aioo seems to be not installed

Hi everyone: I've a server running AIX 6.1 which had initialy technology level =0, after an upgrade oslevel -s reports that it was increased to 6100-04-02, however after doing this the aioo command seems to be not present, what did I do wrong? edit: lslpp shows bos.rte.aio was installed: ...

8. Red Hat

Trouble with installed / not installed rpm unixODBC/libodbc.so.1

Hey there, i run 1: on my server (RHEL 6) and getting response that the libodbc is not installed. If i use yum for installation, it tells me, there is no package like this ( 2: ). Since in the description of Definiens is mentioned that the Run-time dependency is unixODBC (libodbc.so.1), I assume...

9. OS X (Apple)

Just installed El Capitan...

Just updated from Yosemite to El Capitan on my iMac... What an improvement! The front end is really slick now on this tool... Still using OSX 10.7.5 on my laptop and the Applescript code inside AudioScope.sh is now broken under El Capitan but the rest of AudioScope.sh works on it......

10. UNIX for Beginners Questions & Answers

Bash find version of an installed application but if none is found set variable to App Not Installed

Hello Forum, I'm issuing a one line bash command to look for the version of an installed application and saving the result to a variable like so: APP=application --version But if the application is not installed I want to return to my variable that the Application is not installed. So I'm...

LEARN ABOUT DEBIAN

bup-web

bup-ftp(1)						      General Commands Manual							bup-ftp(1)

NAME

       bup-web - Start web server to browse bup repositiory

SYNOPSIS

       bup web [[hostname]:port]

DESCRIPTION

       bup web	starts	a web server that can browse bup repositories.	The file hierarchy is the same as that shown by bup-fuse(1), bup-ls(1) and
       bup-ftp(1).

       hostname and port default to 127.0.0.1 and 8080, respectively, and hence bup web will only offer up  the  web  server  to  locally  running
       clients.  If you'd like to expose the web server to anyone on your network (dangerous!) you can omit the bind address to bind to all avail-
       able interfaces: :8080.

EXAMPLE

	      $ bup web
	      Serving HTTP on 127.0.0.1:8080...
	      ^C

	      $ bup web :8080
	      Serving HTTP on 0.0.0.0:8080...
	      ^C

SEE ALSO

       bup-fuse(1), bup-ls(1), bup-ftp(1), bup-restore(1)

BUP

       Part of the bup(1) suite.

AUTHORS

       Joe Beda <jbeda@gmail.com>.

Bup unknown-																bup-ftp(1)