You should be mostly concerned with what is in your startup scripts and init.d directory. Do a &quot;netstat -antu&quot; and start with those. Look for anything &quot;LISTEN&quot;ing on a non-loopback interface. Do you know what they all are and why they are running? If not, then figure out what they are and eliminate them.<br>
<br>99.9999967% of systems should only be listening on 22, 80 and 443. FTP is also good for file distribution situations that require no security...but in these instances I still recommend bit torrent and seeding. Its more &quot;net-friendly&quot;.<br>
<br><br><div class="gmail_quote">On Mon, Mar 17, 2008 at 1:33 PM, Josef Lowder &lt;<a href="mailto:joe@actionline.com">joe@actionline.com</a>&gt; wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
.<br>
On Mon, 17 Mar 2008 09:17, Matt Graham wrote (in part)<br>
<div class="Ih2E3d">&gt; After a long battle with technology, Josef Lowder wrote:<br>
&gt; &gt; This is all very interesting ... and confusing for my simple mind.<br>
&gt; &gt; It sounds like most of the replies to my question pertain to<br>
&gt; &gt; boxes that are used as &quot;servers&quot; and not just &quot;regular users.&quot;<br>
&gt; &gt; Or are we all &quot;servers&quot;?<br>
&gt;<br>
&gt; If you&#39;re running sshd/apache/smbd/postfix/sendmail/exim/telnetd/<br>
&gt; anything like that, then you are a server.<br>
<br>
</div>As far as I know, I am not running any of those things.<br>
<div class="Ih2E3d"><br>
&gt; &gt; How can I determine if one of my computers has had something<br>
&gt; &gt; like this done?<br>
&gt;<br>
&gt; &quot;chkrootkit&quot; is a starting point. tripwire is another<br>
<br>
</div>I don&#39;t have either of those ... and again it sounds like those<br>
have something to do with checking things on a server box.<br>
<br>
My system seems to have slowed down quite a bit (even when I don&#39;t<br>
have any programs running) and I can&#39;t figure out why.<br>
<br>
When I run &#39;top&#39; I can only see the top 50 or so entries on my monitor<br>
and I don&#39;t know how to see what else might be there farther down the<br>
list.<br>
<br>
And when I do &#39;ps -ef&#39; (see the list below) how can I tell which,<br>
if any, of those processes could be or should be eliminated ...<br>
and how to do that?<br>
<br>
-------------------------------------<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp; 0 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:03 init [5]<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 2 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [ksoftirqd/0]<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 3 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:03 [events/0]<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 4 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [khelper]<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 5 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kthread]<br>
root &nbsp; &nbsp; &nbsp; &nbsp; 7 &nbsp; &nbsp; 5 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kacpid]<br>
root &nbsp; &nbsp; &nbsp; &nbsp;81 &nbsp; &nbsp; 5 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kblockd/0]<br>
root &nbsp; &nbsp; &nbsp; 113 &nbsp; &nbsp; 5 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [pdflush]<br>
root &nbsp; &nbsp; &nbsp; 114 &nbsp; &nbsp; 5 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:01 [pdflush]<br>
root &nbsp; &nbsp; &nbsp; 116 &nbsp; &nbsp; 5 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [aio/0]<br>
root &nbsp; &nbsp; &nbsp; 115 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:09 [kswapd0]<br>
root &nbsp; &nbsp; &nbsp; 704 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kseriod]<br>
root &nbsp; &nbsp; &nbsp; 796 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:02 [kjournald]<br>
root &nbsp; &nbsp; &nbsp; 938 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 udevd -d<br>
root &nbsp; &nbsp; &nbsp;1192 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [khubd]<br>
root &nbsp; &nbsp; &nbsp;1577 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:12 [kjournald]<br>
root &nbsp; &nbsp; &nbsp;1583 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kjournald]<br>
root &nbsp; &nbsp; &nbsp;2359 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:40 /sbin/ifplugd -b -i eth0<br>
rpc &nbsp; &nbsp; &nbsp; 2442 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 portmap<br>
root &nbsp; &nbsp; &nbsp;2466 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 syslogd -m 0<br>
root &nbsp; &nbsp; &nbsp;2483 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 klogd -2<br>
root &nbsp; &nbsp; &nbsp;2515 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/sbin/acpid<br>
root &nbsp; &nbsp; &nbsp;2551 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 rpc.statd<br>
root &nbsp; &nbsp; &nbsp;2635 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:03 cupsd<br>
root &nbsp; &nbsp; &nbsp;2780 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 [kgameportd]<br>
root &nbsp; &nbsp; &nbsp;2814 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 dhclient -1 -q -lf<br>
/var/lib/dhcp/dhclient-eth0.leases -pf /var/run/dhc<br>
xfs &nbsp; &nbsp; &nbsp; 3003 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 xfs -port -1 -daemon -droppriv<br>
-user xfs<br>
71 &nbsp; &nbsp; &nbsp; &nbsp;3018 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 dbus-daemon-1 --system<br>
root &nbsp; &nbsp; &nbsp;3033 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:05:21 hald<br>
root &nbsp; &nbsp; &nbsp;3180 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/bin/kdm -nodaemon<br>
root &nbsp; &nbsp; &nbsp;3189 &nbsp;3180 69 Mar07 tty7 &nbsp; &nbsp; 7-01:53:38 /etc/X11/X -deferglyphs 16<br>
:0 -auth /var/run/xauth/A:0-K9voZd<br>
root &nbsp; &nbsp; &nbsp;3190 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:01:00 nifd -n<br>
nobody &nbsp; &nbsp;3252 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 mDNSResponder<br>
daemon &nbsp; &nbsp;3268 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/sbin/atd<br>
root &nbsp; &nbsp; &nbsp;3322 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 xinetd -stayalive -reuse<br>
-pidfile /var/run/xinetd.pid<br>
root &nbsp; &nbsp; &nbsp;3699 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /opt/win4lin/bin/vnetd<br>
clamav &nbsp; &nbsp;3775 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:08 /usr/bin/freshclam<br>
--config-file=/etc/freshclam.conf --quiet --daemon<br>
root &nbsp; &nbsp; &nbsp;3791 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 crond<br>
root &nbsp; &nbsp; &nbsp;3861 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/bin/lisa -c /etc/lisarc<br>
root &nbsp; &nbsp; &nbsp;3900 &nbsp; &nbsp; 1 &nbsp;0 Mar07 tty1 &nbsp; &nbsp; 00:00:00 /sbin/mingetty tty1<br>
root &nbsp; &nbsp; &nbsp;3901 &nbsp; &nbsp; 1 &nbsp;0 Mar07 tty2 &nbsp; &nbsp; 00:00:00 /sbin/mingetty tty2<br>
root &nbsp; &nbsp; &nbsp;3902 &nbsp; &nbsp; 1 &nbsp;0 Mar07 tty3 &nbsp; &nbsp; 00:00:00 /sbin/mingetty tty3<br>
root &nbsp; &nbsp; &nbsp;3903 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 login -- root<br>
root &nbsp; &nbsp; &nbsp;3904 &nbsp; &nbsp; 1 &nbsp;0 Mar07 tty5 &nbsp; &nbsp; 00:00:00 /sbin/mingetty tty5<br>
root &nbsp; &nbsp; &nbsp;3905 &nbsp; &nbsp; 1 &nbsp;0 Mar07 tty6 &nbsp; &nbsp; 00:00:00 /sbin/mingetty tty6<br>
joe &nbsp; &nbsp; &nbsp; 4071 &nbsp; &nbsp; 1 &nbsp;0 Mar07 ? &nbsp; &nbsp; &nbsp; &nbsp;00:01:37 /usr/lib/gam_server<br>
root &nbsp; &nbsp; &nbsp;7763 &nbsp;3903 &nbsp;0 Mar10 tty4 &nbsp; &nbsp; 00:00:00 -bash<br>
joe &nbsp; &nbsp; &nbsp;21126 &nbsp; &nbsp; 1 &nbsp;0 Mar15 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/lib/gconfd-2 13<br>
root &nbsp; &nbsp; 17244 &nbsp;3180 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 -:0<br>
joe &nbsp; &nbsp; &nbsp;17264 17244 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /bin/sh /usr/bin/startkde<br>
joe &nbsp; &nbsp; &nbsp;17325 17264 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/bin/perl /usr/bin/mdkapplet<br>
joe &nbsp; &nbsp; &nbsp;17336 17264 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/bin/perl /usr/bin/net_applet<br>
joe &nbsp; &nbsp; &nbsp;17349 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 s2u --daemon=yes<br>
joe &nbsp; &nbsp; &nbsp;17370 17264 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /bin/sh /usr/bin/startkde<br>
joe &nbsp; &nbsp; &nbsp;17371 17370 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 gnome-volume-manager<br>
joe &nbsp; &nbsp; &nbsp;17390 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kdeinit Running...<br>
joe &nbsp; &nbsp; &nbsp;17393 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 dcopserver [kdeinit] --nosid<br>
joe &nbsp; &nbsp; &nbsp;17395 17390 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 klauncher [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17398 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kded [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17410 17390 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 /usr/bin/artsd -F 10 -S 4096<br>
-s 60 -m artsmessage -c drkonqi -l 3 -f<br>
joe &nbsp; &nbsp; &nbsp;17412 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kaccess [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17413 17264 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kwrapper ksmserver<br>
joe &nbsp; &nbsp; &nbsp;17415 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 ksmserver [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17417 17390 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kwin [kdeinit] -session<br>
1014cd7d2d4000120328531400000141940000_1205781<br>
joe &nbsp; &nbsp; &nbsp;17419 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kdesktop [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17422 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:02 kicker [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17424 17390 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 xsettings-kde<br>
joe &nbsp; &nbsp; &nbsp;17426 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 korgac --miniicon korganizer<br>
joe &nbsp; &nbsp; &nbsp;17427 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 krandrtray -session<br>
1014cd7d2d4000115565379600000042880006_1205781767_<br>
joe &nbsp; &nbsp; &nbsp;17429 &nbsp; &nbsp; 1 &nbsp;0 12:24 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 knotify [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17554 17390 &nbsp;0 12:29 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kio_file [kdeinit] file<br>
/home/joe/tmp/ksocket-joe/klauncherFALPab.slav<br>
joe &nbsp; &nbsp; &nbsp;17556 &nbsp; &nbsp; 1 &nbsp;0 12:29 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 kio_uiserver [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17864 17390 &nbsp;1 12:33 ? &nbsp; &nbsp; &nbsp; &nbsp;00:00:00 konsole [kdeinit]<br>
joe &nbsp; &nbsp; &nbsp;17865 17864 &nbsp;0 12:34 pts/1 &nbsp; &nbsp;00:00:00 /bin/bash<br>
joe &nbsp; &nbsp; &nbsp;17910 17865 &nbsp;0 12:34 pts/1 &nbsp; &nbsp;00:00:00 ps -ef<br>
<div><div></div><div class="Wj3C7c"><br>
<br>
---------------------------------------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.plug.phoenix.az.us">PLUG-discuss@lists.plug.phoenix.az.us</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss" target="_blank">http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>&quot;A man is defined by the questions that he asks; and the way he goes about finding the answers to those questions is the way he goes through life.&quot;<br>