Re: Service: Bacula-dir Port: 9101 ?

[torrot@xxxxxxxxxxxxx]

-------- Original Message --------
From: m <maillist@xxxxxxxxxxxx>
Apparently from: owner-or-talk@xxxxxxxxxxxxx
To: or-talk@xxxxxxxxxxxxx
Subject: Re: Service: Bacula-dir Port: 9101 ?
Date: Sun, 02 Sep 2007 18:34:02 +0300

> > Is my box hacked, or is everything in order?
> > It looks very very weird to me, anyway, that "wsip-70-169-134-190.hr.hr.cox.net" is connecting to Bacula-dir.
> > 
> > Source: 10.137.186.251
> > Destination: wsip-70-169-134-190.hr.hr.cox.net
> > Port: 9101
> > Service: Bacula-dir
> > Program: tor
> > 
> > Installed Version
> > 0.1.2.17-1~dapper
> > 
> > #ControlPort 9051 (commented/disabled)
> 
> Are you running anything at that port? Try "netstat -ln |grep 9101".
> 
> You could also try running "grep -R 9101 /etc/*" to see if 9101 is 
> mentioned in any config under the /etc.
> 
> M

oops.. I'm a mailing list rookie (your answer landed in the junk mail box and I didn't notice that and replied my own mail.. sorry!)

I just blocked the service port (at the time) and didn't think about netstat . But.. it was an active connection (according to Firestarter).

// torrot, the Linux and mailing-list rookie