Re: [cobalt-security] worried about seeing connections to :81

[william ross <will@xxxxxxxxxxx>]

At 10:35 am +0000 6/12/01, Ben Liddicott wrote:
> Port 81 is the port used by the admin interface. The thing to do is 
> check the IPs that are connected. They should all be either you
> or your customers...

they're not. there's only one client on that machine and none of 
those ips are it. that's why i was concerned. so it is a sign of 
something sinister going on, would you say?

i don't mind completely closing port 81, but i had been trying to 
keep the admin interface reasonably relevant for the day someone else 
has to maintain the machine.

thanks

will


> Cheers,
> Ben Liddicott
> ----- Original Message -----
> From: "william ross" <will@xxxxxxxxxxx>
>
> >  i'm not very up on netstat and its output, so i'd be very glad if
> >  someone could tell me whether to worry or not. i'm puzzled to see a
> >  lot of connections to :81 in the output. most are closed (about 50)
> >  but several appear to be open.
> >
> >  (this is in addition to the five or six www connections one would expect).
> >
> >  i was investigating the fact that the admin interface has stopped
> >  responding, if that sheds any light. it certainly adds to my anxiety
> >  :(
> >
> >  portsentry is running, and in quite a paranoid state, but i've never
> >  interfered much with (or, indeed, used) the admin interface or port
> >  81.
>
>
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security