Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

For some reason, Apache is redirecting all requests to port 23.. or maybe it isn't apache, but something is doing it. This started happening randomly and for no apparently reason.. Anyone know what the problem could be? My users aren't getting error messages, it just says they can't connect.

share|improve this question
1  
What do you mean, 'redirecting'. Are users getting a 301 or 302 redirect response header when they do a request, with a Location that includes port 23? – Martijn Heemels Jun 8 '12 at 22:38
Could you show the output of sudo lsof -i :80? – Martijn Heemels Jun 8 '12 at 22:38
In configserver firewall it's saying that my server is trying to make outbound connection on port 23. i have verified the user's IP addresses who are having trouble with it so I know it isn't a malicious attempt. – Tar Jun 8 '12 at 22:59
1  
@Tar Can you provide the log entries, details about how you determined that the HTTP requests are related in some way to the tcp/23 connections, and details about those outbound telnet connections? We need some hard information if we're going to do any better than guessing. – Shane Madden Jun 8 '12 at 23:10
1  
If I'm going to guess without hard information, I'd guess that you have had some kind of server-side script injected into your site that is opening outbound telnet connections whenever the script is loaded. Where are these port 23 connections going to? All one place? – DerfK Jun 9 '12 at 1:21
show 4 more comments

1 Answer

up vote 0 down vote accepted

my first check would be iptables... it is probably forward port 80 requests to port 23.

iptables -nL -v --line-numbers | grep "ACCEPT" | egrep <port number>

Also have a look at what ports your server is listening on. It should say listening on port 80 like so

tcp 0 0 <ip>:81 0.0.0.0:* LISTEN

netstat -an | grep LISTEN | egrep "80"

netstat -an | grep LISTEN | egrep "23"

you can quickly disable iptables, this will confrim if it is iptables. Normally:

/etc/init.d/iptables stop

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.