Re: rndc (Named)

Hi Tina,

> Hello All,
>
> This is the output of my
>
> nmap -sT -sU -p 1-65535 localhost
>
> ********************OutPut***********************
> Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ )
> Interesting ports on localhost (127.0.0.1):
> (The 131048 ports scanned but not shown below are in state: closed) Port
>       State       Service
> 21/tcp     open        ftp
> 25/tcp     open        smtp
> 53/tcp     open        domain
> 53/udp     open        domain
> 80/tcp     open        http
> 110/tcp    open        pop-3
> 143/tcp    open        imap2
> 443/tcp    open        https
> 465/tcp    open        smtps
> 953/tcp    open        rndc   <<<<<<<< *************:(:(
> 993/tcp    open        imaps
> 995/tcp    open        pop3s
> 2082/tcp   open        unknown
> 2083/tcp   open        unknown
> 2084/tcp   open        unknown
> 2086/tcp   open        unknown
> 2087/tcp   open        unknown
> 2095/tcp   open        unknown
> 2096/tcp   open        unknown
> 3306/tcp   open        mysql
> 6666/tcp   open        irc-serv
> 56222/udp  open        unknown
>
>
> Nmap run completed -- 1 IP address (1 host up) scanned in 70 seconds
>
> When i do
> /usr/sbin/lsof -i tcp:953
> ***********OutPut************************************
> COMMAND   PID USER   FD   TYPE  DEVICE SIZE NODE NAME
> named   14142 root   21u  IPv4 9919024       TCP localhost:rndc (LISTEN)
> named   14144 root   21u  IPv4 9919024       TCP localhost:rndc (LISTEN)
> named   14145 root   21u  IPv4 9919024       TCP localhost:rndc (LISTEN)
> named   14146 root   21u  IPv4 9919024       TCP localhost:rndc (LISTEN)
> named   14147 root   21u  IPv4 9919024       TCP localhost:rndc (LISTEN)
>
> I can kill these Pids but why Named(Bind) is shown there and why it goes
> on 953 port ?

Don't kill the pid, firewall the damn thing. You don't need to have rndc
available except from the localhost.

Question: Do you have an IRC server running? If not, do a system check for
trojans. You just might be sharing more than you intnend to. You just got
through one serious security faux-pas, let's not have another, okay?

Whay are you runing ftp as a standalone server? What ftp daemon are you
using?

Do another chack: run netstat -tuan to see what is happening as far as
active (ESTABLISHED) connections to/from the box.

> is it harmful having such thing???
>
> Help me?? :(
>
> Regards,
> Tina

You're really new at this, aren't you? I see you trying hard, but are you
ready for primetime running mail and dns on the Internet yet? There are a
thousand ways to abuse either if you're not aware of them.

-- 
BeechTree Information Technology Services Inc.
Toronto, Canada
(416)696 6070