Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a few EC2/Scalr instances with zabbix monitoring. I received complaints about one of my servers port scanning other servers. the logs show it is accessing port 22 on consecutive IP addresses.

I looked at the processes list and saw scanssh is running under the user Zabbix.

My question is- Is scanssh part of zabbix? Is it suppesd to run? I have active autodiscovery on zabbix but it is looking at another IP addresses and definately not port 20. Is it possible that something in the config of zabbix agent is controlling it and not the settings on zabbix server?

What can I do to find out if zabbix is somehow misbehaving or it is a hacker? Any advice is highly appreciated.

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

scanssh is definitely not a part of zabbix - it is actually a separate ssh scanner (http://monkey.org/~provos/scanssh/).

it looks like your zabbix user account has been compromised. wipe the account and set it up anew using a different password (if you used one, of course). it might be also helpful to figure out which version of zabbix exactly are you running

share|improve this answer
add comment

This might be due to a SQL Injection problem in <1.8.1 http://www.securityfocus.com/archive/1/510480

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.