UNIX for Dummies Questions & Answers

After running a port-scan (nmap) on my system (Linux Slackware 8.0) I got expected results except for one line:

Port State Service
3333/tcp open dec-notes

What is "dec-notes" and what is it used for ? Any security risks in having this service open ?

/ JP

"DEC Notes is a program for electronic
conferencing. DEC Notes is a computer-mediated
conferencing system that lets you conduct online
conferences or meetings."

It's basically a bulletin board service.
Personally, I've only seen DEC Notes servers on
VAX's but that was several years ago.

I'm assuming that you are not (and have never)
using it. You should go ahead and close the port.

Ah thanx.. well since i wont be using this BBS I'll just shut it down.. but the problem is I can't seem to find where to shut this service off
I've checked the /etc/inetd.conf and the /etc/rc.d/* files for DEC notes but without luck.. I'm not even sure wether the service itself is called DEC-notes..

any suggestions ?

To be honest, I've never used Slackware (RH only).
I assume you have the service "dec-notes" named in
/etc/services. Since you've already looked at
the places I would have suggested, I can only
say to try /etc/inittab as well.

Assuming you have the service defined in
/etc/services, you could go to single user mode,
comment out the service on port 3333 then
restart multiuser run level than look for errors
in the system logs to try to trace what is
starting this up. This assumes the service is
started when you go into multiuser mode and
must have a port defined in /etc/services. If
not, then it woun't help much.

BTW: Commenting out or in ports in /etc/services does not disallow or allow services. /etc/services is just a mapping between the friendly name and the port number. A daemon process can start and run without any reference in /etc/services if it opens the port based on port number.

If you call a service by name, then yes the mapping helps to find the port.... however this is not enabling a port, per se, just doing the port number to name mapping......

On another note....

Might be easier to just see if you can use a program like lsof to find out what process using the port.. then you can follow the trail to the parent processes to find out where the process is initiated.

Absolutely correct Neo. I was not
clear... my suggestion was simply for the
possibility of causing warning messages to
be generated in the system logs to possibly
find where it is started from. Again, this does
not always work (most of the time it does NOT)
but some times I get lucky.

J.P., as Neo suggests, "lsof" is a much better
alternative if you have it available.

Thanks for the clarification and additional
suggestion Neo

thx for the help.. and btw, nice christmas decorations