Why s port 111 still open?

2011-08-29 Thread Lisi
I was under the impression that I had cleansed my system of rpcbind after the security discussion on this list. Today, because I was trying to remove Samba, I ran nmap to see what was going on. Here is the conversation I had with Tux just now: quote lisi@Tux:~$ nmap Tux Starting Nmap 4.62 (

Re: Why s port 111 still open?

2011-08-29 Thread Scott Ferguson
On 29/08/11 19:38, Lisi wrote: I was under the impression that I had cleansed my system of rpcbind after the security discussion on this list. Today, because I was trying to remove Samba, I ran nmap to see what was going on. Here is the conversation I had with Tux just now: quote lisi@Tux:~$

Re: Why s port 111 still open?

2011-08-29 Thread Scott Ferguson
On 29/08/11 19:38, Lisi wrote: I was under the impression that I had cleansed my system of rpcbind after the security discussion on this list. Today, because I was trying to remove Samba, I ran nmap to see what was going on. Here is the conversation I had with Tux just now: quote lisi@Tux:~$

Re: Why s port 111 still open?

2011-08-29 Thread Jochen Spieker
Lisi: quote lisi@Tux:~$ nmap Tux Starting Nmap 4.62 ( http://nmap.org ) at 2011-08-29 10:31 BST Interesting ports on Tux (192.168.0.2): Not shown: 1711 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 6881/tcp open bittorrent-tracker

Re: Why s port 111 still open?

2011-08-29 Thread Lisi
On Monday 29 August 2011 11:00:18 Scott Ferguson wrote: ===Copy of what I just posted to Yuri query= Thanks Scott and sorry. That email landed on my box after I had sent my query. Lisi -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of

Re: Why s port 111 still open?

2011-08-29 Thread Ivan Shmakov
Jochen Spieker m...@well-adjusted.de writes: Lisi: […] lisi@Tux:~$ find rpcbind find: `rpcbind': No such file or directory This command doesn't do what you expect. It prints all files found in the directory rcpbind in your current working directory. Since no such directory exists,

Re: Why s port 111 still open?

2011-08-29 Thread Tom H
On Mon, Aug 29, 2011 at 5:38 AM, Lisi lisi.re...@gmail.com wrote: I was under the impression that I had cleansed my system of rpcbind after the security discussion on this list.  Today, because I was trying to remove Samba, I ran nmap to see what was going on.  Here is the conversation I had

Re: Why s port 111 still open?

2011-08-29 Thread shawn wilson
Your issue seems to be resolved. However, I'd prefer to teach a man to fish As it were, lsof -i :111 should show you the pid of what is on that port. From there, ps and then look through logs or 'find /etc/unit.d -type f -print0 | xargs -0 -i{} grep p name {}' sometimes works. But if you don't

Re: Why s port 111 still open?

2011-08-29 Thread Lisi
On Monday 29 August 2011 13:29:49 Tom H wrote: On Mon, Aug 29, 2011 at 5:38 AM, Lisi lisi.re...@gmail.com wrote: I was under the impression that I had cleansed my system of rpcbind after the security discussion on this list.  Today, because I was trying to remove Samba, I ran nmap to see

Re: Why s port 111 still open?

2011-08-29 Thread Lisi
On Monday 29 August 2011 15:29:41 shawn wilson wrote: Your issue seems to be resolved. However, I'd prefer to teach a man to fish As it were, lsof -i :111 should show you the pid of what is on that port. From there, ps and then look through logs or 'find /etc/unit.d -type f -print0 | xargs

Re: Why s port 111 still open?

2011-08-29 Thread Ivan Shmakov
Lisi lisi.re...@gmail.com writes: On Monday 29 August 2011 15:29:41 shawn wilson wrote: Your issue seems to be resolved. However, I'd prefer to teach a man to fish As it were, lsof -i :111 should show you the pid of what is on that port. From there, ps and then look through logs or

Re: Why s port 111 still open?

2011-08-29 Thread Bob Proulx
Lisi wrote: lisi@Tux:~$ lsof -i :111 lisi@Tux:~$ Needs to be run as root. $ lsof -i :111 $ sudo lsof -i :111 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME portmap 1569 daemon4u IPv4 7285 0t0 UDP *:sunrpc portmap 1569 daemon5u IPv4 5039 0t0 TCP

Re: Why s port 111 still open?

2011-08-29 Thread shawn wilson
On Mon, Aug 29, 2011 at 12:49, Bob Proulx b...@proulx.com wrote: Lisi wrote: lisi@Tux:~$  lsof -i :111 lisi@Tux:~$ Needs to be run as root.  $ lsof -i :111  $ sudo lsof -i :111  COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME  portmap 1569 daemon    4u  IPv4   7285      0t0  

Re: Why s port 111 still open?

2011-08-29 Thread Ivan Shmakov
shawn wilson ag4ve...@gmail.com writes: […] root@shawn-desktop:/home/shawn# find /etc/init.d/ -type f -print0 | xargs -0 -i{} grep -H portmap {} As a news:comp.unix.shell regular, I simply cannot leave such a command line in its present state. First of all, {} is

Re: Why s port 111 still open?

2011-08-29 Thread Lisi
On Monday 29 August 2011 17:49:13 Bob Proulx wrote: Lisi wrote: lisi@Tux:~$ lsof -i :111 lisi@Tux:~$ Needs to be run as root. $ lsof -i :111 $ sudo lsof -i :111 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME portmap 1569 daemon4u IPv4 7285 0t0 UDP

Re: Why s port 111 still open?

2011-08-29 Thread Jochen Spieker
Lisi: So the fact that nmap says that 111 is open for rpcbind does not mean that it is open for rpcbind?? Exactly. Nmap can only guess what program is listening on the other end. An easy test: (0) (root@jigsaw):~# nc -l -p 80 [1] 17913 (1) (root@jigsaw):~# nmap localhost | grep 80

Re: Why s port 111 still open?

2011-08-29 Thread Bob Proulx
Jochen Spieker wrote: Anyway, using nmap on localhost doesn't make much sense. Use netstat or lsof instead. Agreed. For example if you have a firewall on the local host. Usually connections from the local host to the local host are allowed but inbound connections from other hosts are blocked.

Re: Why s port 111 still open?

2011-08-29 Thread shawn wilson
On Mon, Aug 29, 2011 at 16:18, Jochen Spieker m...@well-adjusted.de wrote: Lisi: So the fact that nmap says that 111 is open for rpcbind does not mean that it is open for rpcbind?? Exactly. Nmap can only guess what program is listening on the other end. An easy test: (0) (root@jigsaw):~#

Re: Why s port 111 still open?

2011-08-29 Thread shawn wilson
On Mon, Aug 29, 2011 at 16:30, Bob Proulx b...@proulx.com wrote: Jochen Spieker wrote: Anyway, using nmap on localhost doesn't make much sense. Use netstat or lsof instead. Agreed.  For example if you have a firewall on the local host. Usually connections from the local host to the local