Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently figured out that a program called portsentry is listening on ports 1 and 111 on my server, but I don't remember installing it!

I wonder if it is a malicious service.

I searched through the logs and found this:

portsentry is not up to date (Wed Dec 31 19:00:00 1969)
Fetching http://httpupdate.cpanel.net/pub/sysup/9-64/portsentry/portsentry-1.1-5.x86_64.rpm (0)....@74.50.xxx.xxx......connected......receiving...100%......Done
portsentry                  ##################################################

Sep 13 06:35:47 host portsentry[4681]: adminalert: Psionic PortSentry 1.1 is starting.
Sep 13 06:35:48 host portsentry[4685]: adminalert: Going into listen mode on TCP port: 1
Sep 13 06:35:48 host portsentry[4685]: adminalert: Going into listen mode on TCP port: 111
Sep 13 06:35:48 host portsentry[4685]: adminalert: PortSentry is now active and listening.
Sep 13 06:35:48 host portsentry[4686]: adminalert: Psionic PortSentry 1.1 is starting.
Sep 13 06:35:48 host portsentry[4687]: adminalert: ERROR: No UDP ports supplied in config file. Aborting

I have a CentOS with CPanel...

Thank you!

share|improve this question

2 Answers 2

up vote 1 down vote accepted

PortSentry comes with cPanel by default and is therefore installed on your system when you have cPanel installed. If you do have cPanel installed, there's nothing to worry about.

From http://www.faqs.org/docs/securing/chap14sec116.html:

A port scan is a symptom of a larger problem coming your way. It is often the pre-cursor for an attack and is a critical piece of information for properly defending your information resources. PortSentry is a program designed to detect and respond to port scans against a target host in real-time and has a number of options to detect port scans. When it finds one it can react in the following ways:

A log indicating the incident is made via syslog(). The target host is automatically dropped into /etc/hosts.deny for TCP Wrappers. The local host is automatically re-configured to route all traffic to the target to a dead host to make the target system disappear. The local host is automatically re-configured to drop all packets from the target via a local packet filter. The purpose of this is to give an admin a heads up that their host is being probed.

share|improve this answer

PortSentry is an intrusion detection system. It can alert you or log any suspected attempts to attack your system remotely. It might even be able to report these directly to your firewall to temporarily increase security during suspicious behavior. It probably came with your operating system or firewall, and you should leave it running.

share|improve this answer
    
are you sure it comes with my CentOS? I never got any reports/notifications from it! –  Zenet Sep 21 '10 at 20:47
    
It looks like CPanel comes with PortSentry. If you never got notifications before, you're probably seeing them now because it's complaining about being out-of-date. Make sure you don't have a firewall blocking the server httpupdate.cpanel.net. Also, check for updates for the server by running (as root) yum update then yum upgrade. If that doesn't work, see if there is a newer version of CPanel from cpanel.net –  TuxRug Sep 21 '10 at 21:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.