I SSH into root and noticed the previous user used this command: telnet randomdomain.com 25

From what I gathered it is connecting to another server? But that domain doesn't have anything to do with my site, and it doesn't even show up in google. The only one who has my root password is my host.

What are the reasons for using the telnet command? Is this something to be worried about or am I just being paranoid? There were no further commands after that one.


There are many reasons to use telnet. In your case it looks like the person was trying to connect to the SMTP port on a remote host. You would normally connect to a FQDN or ip address but this person was trying to connect to whatever ip address the naked domain resolves to. Why they were doing that is anybody's guess.

  • Are they able to do anything dangerous by doing this? In other words, is this anything to worry about? I didn't notice any changes to my website files. For now I just changed the root password. Should I be taking any further measures? – user1699176 Oct 27 '12 at 18:21
  • 4
    There are two issues at work here: 1. Does the fact that the user tried to connect to a remote domain on port 25 mean anything? Probably not. They can't harm your server by connecting to the SMTP port on a remote server. 2. Does the fact that you can't account for who it was and how they got access to your server mean anything? Yes it does. If you can't account for who, why, and how then you should consider your server as being compromised. The best course of action would be to wipe it and rebuild it from scratch. – joeqwerty Oct 27 '12 at 18:25
  • Well I never actually asked my host whether they were the one who did that. I find it hard to ask them if they did, it feels like I am suspecting them for trying to do something heh. If it was an outsider, wouldn't they do something more damaging? FWIW, it's also already been a week. – user1699176 Oct 27 '12 at 18:34
  • 1
    If you're paying them for the server then you have every right to ask them if they were on your server and why. – joeqwerty Oct 27 '12 at 18:47
  • I ended up asking them and they said it was harmless, nothing I should worry about since I changed my pass... – user1699176 Oct 27 '12 at 19:28

telnet is a protocol used in several applications. E.g most MUDs still use telnet.

Non game uses for telnet include:

  1. Testing a mail server (telnet to port 25).
  2. Testing a web server.

Mail example:

>telnet mail.stack.nl 25
Trying 2001:610:1108:5010::104...
Connected to relay02.xxx.xxx.
Escape character is '^]'.
220 mx1.stack.nl ESMTP Postfix
HELO example.mydomain.tld
250 mx1.stack.nl

(That is the output of a mail server being greeted by my 'client'.)

Or testing the webserver here at serverfault.

telnet serverfault.com 80
Connected to serverfault.com.
Escape character is '^]'.
HTTP/1.0 400 Bad request
Cache-Control: no-cache
Connection: close
Content-Type: text/html
400 Bad request
Your browser sent an invalid request.

Connection closed by foreign host.

Note that these are the same command a client would sent. No extra options are gained. The advantage is that you do not need to install extra software (telnet usually comes preinstalled) and then you get the raw error message rather than some 'human friendly' message.

  • Thanks for the explanation. So basically the user in my case was testing a mail server, not of my site, but a random domain... I have no idea why they need to do that, but now that I think about it, if they logged into root, they could have done a lot worse, so maybe I'm overthinking it. Maybe also the possibility they typed that in the wrong terminal or something? Not sure. – user1699176 Oct 27 '12 at 18:29
  • Someone unknown to you was logged in as root, and you are the only admin of that server? Then assume your system is compromised. If you entered any passwords since then assume those are known to whoever got into your system. -- Having said that, yes, the command you found is harmless to you. – Hennes Oct 27 '12 at 18:31
  • My host also has my password, it's possible it could be my host, but not sure. Is this something a host would do? I'm wondering if they accidentally typed/pasted that in to the wrong terminal. Well I'd have to ask to make sure. It has been a week since this happened I believe, so I think I will just leave it for now. – user1699176 Oct 27 '12 at 18:39
  • I would not think twice before I did that from a server which I co-managed. The command itself is as harmless as typing 'ls'. But on servers which I co-manage we have separate admin accounts (not called root, but with uid 0). – Hennes Oct 27 '12 at 18:59
  • 2
    so I think I will just leave it for now. that's a mistake. If its your server and its running something you care about, you need to be more proactive about figuring out whether or not it has been compromised. – Rob Moir Oct 27 '12 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.