> Are you sure this is in fact the one connection you are closing?

I don't see what else it could be, certainly nothing legitimate. The
only access to the box was me testing xrdp, running a tail -f
alongside.

> Is the system connected to the internet (and reachable from there on the RDP
> port)?

Yes, it's connected to the internet, no it's not reachable from
outside the LAN (on any port).

> Removing the security tag as I do not see how IP based connections from
> somewhere to your host could be a security bug in xrdp.

Well, either xrdp is "phoning home" (worrying, but unlikely) or the
displayed IP address is bogus (parsing error, an off pointer ...) --
both are potentially security relevant.

Cheers,
C.

Reply via email to