Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

in last few weeks i noticed that firewall on my server is stopped few times.

when i start it it works for a few days, but after that i found it stopped. i run it again, few days after it is stopped again.

i use iptables.

i have enough memory, enough free space on hard drives.

what can be a case? i am worried that i have "somebody" on my server.

please advice me...

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Please try to do a simple scan of your machine, and check if your box is not hacked, or carrying out a rootkit, there are many package that can help you for example :


chkrootkit:  rootkit detector
rkhunter  :  rootkit, backdoor, sniffer and exploit scanner
unhide    :  Forensic tool to find hidden processes and ports

share|improve this answer

Keep in mind, just because the "service" is saying it's stopped doesn't mean the firewall is actually gone. At least on CentOS, the "service" seems to just be a wrapper for saving and restoring rulesets. There's no actual userspace daemon required for iptables to work; it's just a series of CLI tools that talk to the kernel to actually set the rules. The real way to tell if the iptables rules are still present is to run "iptables -L"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.