Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A friend is investigating break-ins on some of his servers, and he has noticed that on several of them (from very recent CentOS all the way back to one old ancient RHL 9) the crond process is listening on port 6550/tcp, which is identified in /etc/services as "fg-sysupdate". The crond does not appear to be hacked, and the listening is happening even one one box that he's nearly certain was not compromised.

None of my CentOS boxes have crond listening on that (or any other) port. And the crond manual doesn't have any information about configuring it to listen or not listen. So we're just puzzled as to why crond would be listening on this port, and how to turn that off if it's not needed.

share|improve this question
    
Hrm, that's really odd. I have no ideas for you, but just wanted to pop in and say "Hi". It's nice to see a familiar face around! –  EEAA Nov 12 '10 at 22:05
    
Well, hey, Erik! Long time. –  bjnord Nov 14 '10 at 0:40

1 Answer 1

up vote 1 down vote accepted

crond has no need to listen on any TCP port. I would suspect a rootkit.

What response does your friend get when telneting to port 6550?

I would boot from a live CD/DVD and compare checksums.

share|improve this answer
    
Thanks for the telnet suggestion; great idea, I should have thought of that. You're right... connecting to that port gives a shell prompt. Looks like his initial conclusion was wrong; the crond is indeed hacked... he's going to rebuild the boxes from scratch. –  bjnord Nov 14 '10 at 0:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.