| View previous topic :: View next topic |
| Author |
Message |
salam
Apprentice
Joined: 29 Sep 2005
Posts: 227
|
 Posted: Sun Aug 13, 2006 5:55 am Post subject: sshd under uid 0 connects out? |
 |
|
Hello,
I found a flood of messages in my logs that sshd(running as uid 0) tries to connect out to port 0 UDP to 2 ip addresses which belong to the same ISP. Can someone please explain me why this happens? |
|
| Back to top |
|
 |
dev-urandom
Apprentice
Joined: 24 Jun 2005
Posts: 260
Location: Huh?
|
| Posted: Sun Aug 13, 2006 7:32 am Post subject: Re: sshd under uid 0 connects out? |
|
|
| salam wrote: | | I found a flood of messages in my logs that sshd(running as uid 0) tries to connect out to port 0 UDP to 2 ip addresses which belong to the same ISP. Can someone please explain me why this happens? |
SSH uses only tcp iirc. port 0 is pretty vague, it usually doesn't mean anything. What scheduled jobs do you run, from cron, at or somewhere else?
_________________
/earth: file system full. |
|
| Back to top |
|
|
salam
Apprentice
Joined: 29 Sep 2005
Posts: 227
|
| Posted: Sun Aug 13, 2006 6:04 pm Post subject: |
|
|
only from cron and these jobs: raidtools,logrotate and quotacheck which run daily
makewhatis which runs weekly
it happened never before (yesterday) and i've seen no such message after this flood in logs
the connection was prevented by ACL system, see the complete message:
| Code: | grsec: From xxx.xxx.26.2: (root:U:/usr/sbin/sshd) denied connect() to xxx.xxx.27.1 port 0 sock type dgram protocol udp by /usr/sbin/sshd[sshd:31379] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/sshd[sshd:8376] uid/euid:0/0 gid/egid:0/0
|
that ip is related to me in no way, it is completely foreign for me(though it comes from the very opposite side of my country)
there are exactly 124 connection attempts logged, each one was denied |
|
| Back to top |
|
|
|
Networking & Security
