Board index Unix Security

Port 1025???

Port 1025???

Post by Klaus Kusch » Sat, 24 May 1997 04:00:00






> >On many of our Unix systems (AIX, DEC Unix),
> >netstat shows that somebody is listening on
> >port 1025 (tcp).

> >I found out that the program listening there
> >is inetd, but I was unable to find a line in
> >/etc/inetd.conf corresponding to that port.

> >Questions:
> >* Which service or program corresponds to port 1025?
> >* Where is it configured, how is it turned on or off?
> Do your systems run the NFS moung daemon out of inetd?  Some do,
> and through the normal portmapper mechanism, tend to get port 1025.
> You can prove or disprove this idea with `rpcinfo -p`, as in:

> % rpcinfo -p
>    program vers proto   port
>  ....
>     100005    1   udp   1025  mountd
>  ....


Not the case, the rpcinfo -p listing does not include port 1025,
and mountd is not in inetd.conf.

I am aware of the "blackjack" entry in /etc/services
for port 1025, but I was unable to find any docu about
blackjack or any actual program corresponding to it.

Moreover, as I said above, the program listening is inetd
(according to lsof), and blackjack does not appear
in /etc/inetd.conf.

Any more ideas???

I don't like open ports on our server
whose purpose is not known to me...

--
DI. Dr. Klaus Kusche
Oberoesterreichische Landesregierung / Government of Upper Austria
Rechenzentrum / Computing Centre
Smail: Kaerntnerstrasse 16, A-4020 Linz, Austria (Europe)
Phone: +43 732 7720 - 3394   Fax: +43 732 7720 - 3198

 
 
 
Top

Port 1025???

Post by Jude Giampao » Sat, 24 May 1997 04:00:00




> Moreover, as I said above, the program listening is inetd
> (according to lsof), and blackjack does not appear
> in /etc/inetd.conf.

> Any more ideas???

Have you tried connecting to the port and seeing what you get back?

--
Jude Giampaolo -- Penn State University -- Electrical Engineering  


 
 
 
Top

Port 1025???

Post by Joerg Lehner » Sat, 24 May 1997 04:00:00






>> >On many of our Unix systems (AIX, DEC Unix),
>> >netstat shows that somebody is listening on
>> >port 1025 (tcp).

>> >I found out that the program listening there
>> >is inetd, but I was unable to find a line in
>> >/etc/inetd.conf corresponding to that port.

>> >Questions:
>> >* Which service or program corresponds to port 1025?
>> >* Where is it configured, how is it turned on or off?
>> Do your systems run the NFS moung daemon out of inetd?  Some do,
>> and through the normal portmapper mechanism, tend to get port 1025.
>> You can prove or disprove this idea with `rpcinfo -p`, as in:

>> % rpcinfo -p
>>    program vers proto   port
>>  ....
>>     100005    1   udp   1025  mountd
>>  ....

>Not the case, the rpcinfo -p listing does not include port 1025,
>and mountd is not in inetd.conf.
[...]
>Any more ideas???

Programes using get*() functions with NIS/YP often create, use
and leave around for later use a TCP sockets to talk to ypserv
on the NIS/YP server machine.
The get*() functions are: getpwnam (), getpwuid(), gethostbyname(),
gethostbyaddr(), getservbyname(), getservbyport(), and more .

Your inetd probably used at least getservbyname().

  Joerg
--

Real: Joerg Lehners, FB 10 Informatik ARBI, Uni Oldenburg, D-26111 Oldenburg
Unwoerter: Kostensenkung - Gewinnmaximierung - billig, billig, billig

 
 
 
Top

Port 1025???

Post by Dav » Sun, 25 May 1997 04:00:00







>> >On many of our Unix systems (AIX, DEC Unix),
>> >netstat shows that somebody is listening on
>> >port 1025 (tcp).

>> >I found out that the program listening there
>> >is inetd, but I was unable to find a line in
>> >/etc/inetd.conf corresponding to that port.

>> >Questions:
>> >* Which service or program corresponds to port 1025?
>> >* Where is it configured, how is it turned on or off?

> I don't like open ports on our server
> whose purpose is not known to me...

My /etc/services lists port 1025 & 1026 (Linux 2.0.27) as:

listen          1025/tcp        listener RFS remote_file_sharing
nterm           1026/tcp        remote_login network_terminal

 
 
 
Top

Port 1025???

Post by Matthew Palm » Tue, 27 May 1997 04:00:00




>> >* Which service or program corresponds to port 1025?
[...]
>> Do your systems run the NFS moung daemon out of inetd?  Some do,
>> and through the normal portmapper mechanism, tend to get port 1025.
[...]
>I don't like open ports on our server
>whose purpose is not known to me...

Neither do I.  A little help on tracking this beastie down.  I use port 1025
for bringing up my part-time Internet link, (any connection brings it up)
and I have no problems with other services bashing into it.  I use NFS
heavily, although I don't use any other RPC services.

Just a thought: Have you tried telnetting into it?  Maybe it'll let you get
in there, and give you some sort of howdy message.  Might help you find the
culprit.

--

-----------------------------------------------------------------------
#include <disclaimer.h>
Matthew Palmer     | Technophile, programmer, and old style hacker.

 
 
 
Top

Port 1025???

Post by David William » Tue, 27 May 1997 04:00:00






>>> >* Which service or program corresponds to port 1025?
>[...]

 Look in /etc/services - it should be listed in there...

Quote:>>> Do your systems run the NFS moung daemon out of inetd?  Some do,
>>> and through the normal portmapper mechanism, tend to get port 1025.
>[...]
>>I don't like open ports on our server
>>whose purpose is not known to me...

>Neither do I.  A little help on tracking this beastie down.  I use port 1025
>for bringing up my part-time Internet link, (any connection brings it up)
>and I have no problems with other services bashing into it.  I use NFS
>heavily, although I don't use any other RPC services.

>Just a thought: Have you tried telnetting into it?  Maybe it'll let you get
>in there, and give you some sort of howdy message.  Might help you find the
>culprit.

--
David Williams
 
 
 
Top

Port 1025???

Post by Arun Kumar Krish » Thu, 29 May 1997 04:00:00


: >>> >* Which service or program corresponds to port 1025?

RFC 1700 on Assigned numbers lists port 1025 as

blackjack       1025/tcp   network blackjack
blackjack       1025/udp   network blackjack

Can anyone throw some light on what blackjack is??

 
 
 
Top

Port 1025???

Post by Klop » Thu, 29 May 1997 04:00:00



: : >>> >* Which service or program corresponds to port 1025?
:
: RFC 1700 on Assigned numbers lists port 1025 as
:
: blackjack       1025/tcp   network blackjack
: blackjack       1025/udp   network blackjack
:
: Can anyone throw some light on what blackjack is??
:

Blackjack is a card game played in the * or in bars.
--
 Ronald Klop            | Vrije Universiteit, Amsterdam, The Netherlands
 Polanenstraat 189      | Faculty of Mathematics & Computer Science
 1013 VV Amsterdam      |
 Tel. 020 6843106       | WWW: http://www.veryComputer.com/~ronald/

 
 
 
Top

Port 1025???

Post by Ian Stirlin » Thu, 29 May 1997 04:00:00



: : : >>> >* Which service or program corresponds to port 1025?
: :
: : RFC 1700 on Assigned numbers lists port 1025 as
: :
: : blackjack       1025/tcp   network blackjack
: : blackjack       1025/udp   network blackjack
: :
: : Can anyone throw some light on what blackjack is??
: :
:
: Blackjack is a card game played in the * or in bars.

And on the network.
: --
:  Ronald Klop            | Vrije Universiteit, Amsterdam, The Netherlands
:  Polanenstraat 189      | Faculty of Mathematics & Computer Science
:  1013 VV Amsterdam      |
:  Tel. 020 6843106       | WWW: http://www.veryComputer.com/~ronald/

--

Notice: Anyone mailing to this account should check the notices in the header.
Ian Stirling.                     Currently designing a new PDA, see homepage.
Homepage:                         http://www.veryComputer.com/
If God hadn't inteneded us to eat animals,
He wouldn't have made them out of MEAT! -John Cleese

 
 
 
Top

Port 1025???

Post by Klaus Kusch » Tue, 03 Jun 1997 04:00:00





> > Moreover, as I said above, the program listening is inetd
> > (according to lsof), and blackjack does not appear
> > in /etc/inetd.conf.

> > Any more ideas???
> Have you tried connecting to the port and seeing what you get back?

Yes, I have (using telnet ... 1025).
I get a connection, but no data is sent on that connection
(no header or copyright). The connection also seems to accept data
without disconnecting, but I got no response at all.

--
DI. Dr. Klaus Kusche
Oberoesterreichische Landesregierung / Government of Upper Austria
Rechenzentrum / Computing Centre
Smail: Kaerntnerstrasse 16, A-4020 Linz, Austria (Europe)
Phone: +43 732 7720 - 3394   Fax: +43 732 7720 - 3198

 
 
 
Top

1. port 1025

There was some discussion recently on port 1025. After telnetting to
port 1025, hit Ctrl bracket and you will enter telnet (at least in the
machine I tried).  Typing help will give you a menu. Hit Ctrl bracket
everytime you get booted out of telnet to put you back in.

2. solaris 7? IP changes

3. Port 1025 Blackjack?

4. file function/usage

5. KDE & port 1025

6. Problems setting ip number and the such.

7. What is udp port 1025??

8. Free Software Institute Classes in NYC

9. blackjack on port 1025/udp?

10. What is port 1025 Blackjack?

11. Port 1025 blackjack ?

12. Hits on port 1025

13. Windoze XP port 1025 in promisc mode causing havoc?


All times are UTC
Board index