5

I SSH into root and noticed the previous user used this command: telnet randomdomain.com 25

From what I gathered it is connecting to another server? But that domain doesn't have anything to do with my site, and it doesn't even show up in google. The only one who has my root password is my host.

What are the reasons for using the telnet command? Is this something to be worried about or am I just being paranoid? There were no further commands after that one.

2 Answers 2

2

There are many reasons to use telnet. In your case it looks like the person was trying to connect to the SMTP port on a remote host. You would normally connect to a FQDN or ip address but this person was trying to connect to whatever ip address the naked domain resolves to. Why they were doing that is anybody's guess.

5
  • Are they able to do anything dangerous by doing this? In other words, is this anything to worry about? I didn't notice any changes to my website files. For now I just changed the root password. Should I be taking any further measures? Oct 27, 2012 at 18:21
  • 4
    There are two issues at work here: 1. Does the fact that the user tried to connect to a remote domain on port 25 mean anything? Probably not. They can't harm your server by connecting to the SMTP port on a remote server. 2. Does the fact that you can't account for who it was and how they got access to your server mean anything? Yes it does. If you can't account for who, why, and how then you should consider your server as being compromised. The best course of action would be to wipe it and rebuild it from scratch.
    – joeqwerty
    Oct 27, 2012 at 18:25
  • Well I never actually asked my host whether they were the one who did that. I find it hard to ask them if they did, it feels like I am suspecting them for trying to do something heh. If it was an outsider, wouldn't they do something more damaging? FWIW, it's also already been a week. Oct 27, 2012 at 18:34
  • 1
    If you're paying them for the server then you have every right to ask them if they were on your server and why.
    – joeqwerty
    Oct 27, 2012 at 18:47
  • I ended up asking them and they said it was harmless, nothing I should worry about since I changed my pass... Oct 27, 2012 at 19:28
2

telnet is a protocol used in several applications. E.g most MUDs still use telnet.

Non game uses for telnet include:

  1. Testing a mail server (telnet to port 25).
  2. Testing a web server.

Mail example:

>telnet mail.stack.nl 25
Trying 2001:610:1108:5010::104...
Connected to relay02.xxx.xxx.
Escape character is '^]'.
220 mx1.stack.nl ESMTP Postfix
HELO example.mydomain.tld
250 mx1.stack.nl

(That is the output of a mail server being greeted by my 'client'.)

Or testing the webserver here at serverfault.

telnet serverfault.com 80
Trying 64.34.119.12...
Connected to serverfault.com.
Escape character is '^]'.
HTTP/1.1
HTTP/1.0 400 Bad request
Cache-Control: no-cache
Connection: close
Content-Type: text/html
400 Bad request
Your browser sent an invalid request.

Connection closed by foreign host.

Note that these are the same command a client would sent. No extra options are gained. The advantage is that you do not need to install extra software (telnet usually comes preinstalled) and then you get the raw error message rather than some 'human friendly' message.

7
  • Thanks for the explanation. So basically the user in my case was testing a mail server, not of my site, but a random domain... I have no idea why they need to do that, but now that I think about it, if they logged into root, they could have done a lot worse, so maybe I'm overthinking it. Maybe also the possibility they typed that in the wrong terminal or something? Not sure. Oct 27, 2012 at 18:29
  • Someone unknown to you was logged in as root, and you are the only admin of that server? Then assume your system is compromised. If you entered any passwords since then assume those are known to whoever got into your system. -- Having said that, yes, the command you found is harmless to you.
    – Hennes
    Oct 27, 2012 at 18:31
  • My host also has my password, it's possible it could be my host, but not sure. Is this something a host would do? I'm wondering if they accidentally typed/pasted that in to the wrong terminal. Well I'd have to ask to make sure. It has been a week since this happened I believe, so I think I will just leave it for now. Oct 27, 2012 at 18:39
  • I would not think twice before I did that from a server which I co-managed. The command itself is as harmless as typing 'ls'. But on servers which I co-manage we have separate admin accounts (not called root, but with uid 0).
    – Hennes
    Oct 27, 2012 at 18:59
  • 2
    so I think I will just leave it for now. that's a mistake. If its your server and its running something you care about, you need to be more proactive about figuring out whether or not it has been compromised.
    – Rob Moir
    Oct 27, 2012 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .