rwho daemon RedHat 8

[Justin Northcraft]

Hi -

I have a RedHat 8 system that appears to have the rwhod service
running
on udp port 513 although I only find that when running a ISS scan
against the machine. I do not find that port open when I scan with
Nessus or Nmap or even using netstat. I've tried using chkconfig but
rwho is not listed anywhere and I also looked to remove any rwho rpm
package and no package exist on the system.

My question... Is this service really running on my system and I'm
just
not looking in the correct place to disable it? or Is ISS picking up
something weird...

Any help is grateful!!

justin


Justin Northcraft, GSEC, CNA
Technology Specialist
Clifton Gunderson LLP

335 N. Wilmot Rd. Suite 300
Tucson, Arizona 85711

Office: [phone] ext. 241
Cell: [phone]
Text Page: (***@VTEXT.COM)

E-Mail: ***@CliftonCPA.com

Web Site: http://www.CliftonCPA.com "When Relationships Count ...
Count on Clifton Gunderson"

[Brian Cyr]

If I am not mistaken (although I usually am :) you are picking up xinetd

It will listen for pre-defined services and if it "hears" a connection then
it will launch the appropriate service to handle the "call". However, you
may not have xinetd configured to execute rwho so you will never get a
connection on that port. Check your /etc/xinetd.d directory.

-----Original Message-----
From: redhat-list-***@redhat.com
[mailto:redhat-list-***@redhat.com]On Behalf Of Justin Northcraft
Sent: Thursday, April 24, 2003 2:00 PM
To: redhat-***@redhat.com
Subject: rwho daemon RedHat 8


Hi -

I have a RedHat 8 system that appears to have the rwhod service
running
on udp port 513 although I only find that when running a ISS scan
against the machine. I do not find that port open when I scan with
Nessus or Nmap or even using netstat. I've tried using chkconfig but
rwho is not listed anywhere and I also looked to remove any rwho rpm
package and no package exist on the system.

My question... Is this service really running on my system and I'm
just
not looking in the correct place to disable it? or Is ISS picking up
something weird...

Any help is grateful!!

justin


Justin Northcraft, GSEC, CNA
Technology Specialist
Clifton Gunderson LLP

335 N. Wilmot Rd. Suite 300
Tucson, Arizona 85711

Office: [phone] ext. 241
Cell: [phone]
Text Page: (***@VTEXT.COM)

E-Mail: ***@CliftonCPA.com

Web Site: http://www.CliftonCPA.com "When Relationships Count ...
Count on Clifton Gunderson"

[Gordon Messmer]

Post by Justin Northcraft
Hi -
I have a RedHat 8 system that appears to have the rwhod service
running
on udp port 513 although I only find that when running a ISS scan
against the machine.

Is the port listed "open" or "filtered"? If the latter, then your
iptables/ipchains rules DROP packets to that port instead of REJECTing them.