Login or Register to Ask a Question and Join Our Community


IP Networking

in.telnetd[5115] -- compromised?

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums IP Networking in.telnetd[5115] -- compromised?
# 1  
Old 09-19-2001
in.telnetd[5115] -- compromised?
/* Linux Slackware */

looking in my logs I see tons of entries similar to below. Does anyone know what these mean, and should I be concerned. I looked up a few of the IP's at Arin.net and saw that many of them belong to isp's (not good).. Any information is helpful..

Body of Messages log
----------------------------

Jun 29 09:06:30 gateway profgpd[5155]:connect from 212.120.97.36

Jun 29 06:11:37 gateway in.telnetd[5102]: connect from root@66.115.18.3

Jul 1 03:07:58 gateway proftpd[5477]: connect from 209.87.230.226

---------------------------

gut feeling is that I have been compromised... am I right??

e0-
# 2  
Old 09-19-2001
It is very possible that you have been
compromised. First, shut off telnet and ftp!!!
Next, check out:
http://www.cert.org/tech_tips/root_compromise.html
...and following these procedures, you should
be able to determine the level of compromise
(if any). A word of advise... never, never,
never leave telnet or ftp (among other things)
open on a system that is connected to the
internet.
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Please help my computer has been compromised

Hi everyone, I hope I am posting in the right spot and I really need some help. I am going through a horrible divorce and I am afraid that my husband has compromised . He set up my mac computer and router and for my job set up remote access for me. I caught him cheating on me and I think he... (6 Replies)
Discussion started by: kk243665
6 Replies

2. Cybersecurity

Server has been compromised

Hi, I want to ask something about server that has been compromised. Recently, one of my VPS server has been hacked and the attacker install somekind like "IRC" script. Everytime I killed the process or close the port, it can open again .. and again ..I'm sure the attacker has installed... (14 Replies)
Discussion started by: franx47
14 Replies

3. AIX

telnetd daemon

Hi, When a client connected to AIX server by telnet is killed/crashes, is there a way for telnetd to recognize that and close/kill the application linked/started by that telnet session? We have a situation where clients disconnect because of frequent network outages, this leaves the... (2 Replies)
Discussion started by: mreyaz
2 Replies

4. SCO

Telnetd Port Options

Ok, here i am in 2008 trying to figure out how to edit the port of Telnetd in sco openserver 4.2. I googled my butt off and cant seem to find any info. Does anyone have some specific howto's or good documentation on this? (2 Replies)
Discussion started by: j0ntar
2 Replies

5. Solaris

Can't start telnetd

Hello all, I've got a problem on a V240 running Solaris 9, the telnet daemon won't start. The error message I get is "telnetd: stdin is not a socket file descriptor." I've never seen this message before and I'm not exactly sure what it means. I know generally what stdin, sockets, and file... (4 Replies)
Discussion started by: ONEX
4 Replies

6. Solaris

telnetd bug!

hi mates, a very important info for all solaris admins, there is a bug in telnetd on nearly every solaris version: pressy@mp-wst01 # id uid=100(pressy) gid=1(other) pressy@mp-wst01 # telnet -l "-froot" 192.168.40.1 Trying 192.168.40.1... Connected to 192.168.40.1. Escape character is... (3 Replies)
Discussion started by: pressy
3 Replies

7. Cybersecurity

telnetd vs telnetd -a

Hi folks. I have a quick question on using "telnetd" vs. "telnetd -a". OS: AIX 5.x (5.1 through 5.3 ML3) Some engineers at work want to stop using "telnetd -a" and use "telnetd". (and of course, if I could get a cogent answer from them, I wouldn't be posting this question...) :mad: The... (0 Replies)
Discussion started by: davidl9999
0 Replies

8. UNIX for Dummies Questions & Answers

telnetd: all network ports in use

I hope someone can enlighten me on this. A few weeks ago, the root file system my UnixWare 7.1.1 server became corrupt so I ended up doing a full restore of the OS from tape backup. Since then, after I get about 270 users on the system, the message "telnetd: all network ports in use" is... (1 Reply)
Discussion started by: davekox
1 Replies
Login or Register to Ask a Question