Determin which FTP server is running and turn off non secure FTP

[keith smith]

I think it is important for me to understand what FTP server is running.

Issued : lsof -i :21

Returned : xinetd  2417 root    6u  IPv4   6699       TCP *:ftp (LISTEN)

I assume xinetd means it was started via xinetd?

I will chkconfig once I figure out what FTP server is running.

Thanks!

------------------------

Keith Smith

--- On Wed, 6/23/10, Dan Dubovik <dandubo at gmail.com> wrote:

From: Dan Dubovik <dandubo at gmail.com>
Subject: Re: Determin which FTP server is running and turn off non secure FTP
To: "Main PLUG discussion list" <plug-discuss at lists.plug.phoenix.az.us>
Date: Wednesday, June 23, 2010, 7:28 PM

FTP control channel is on port 21, data is on 20 (for active ftp).  SFTP uses the SSH daemon, so runs on port 22.
It has been my experience that the pure-ftpd init script is far from graceful, as Eric pointed out, the error that was given likely means that the service wasn't running.  That, or it just couldn't find the pid file.

lsof -i :21 will tell you the process (with pid) that is listening on port 21.  You can then kill that process.  Provided you have also used chkconfig to disable the service on startup, it will then effectively be stopped from running.  The rpm -e or yum remove commands listed above will make doubly sure that the service won't be started up again on the server.  Additionally, you could use iptables to disable any connection to port 21 on the server :

/sbin/iptables -A INPUT -p tcp --dport 21 -j REJECT

I think that should stop incoming connections on the port.
-- Dan.

-----Inline Attachment Follows-----

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


      
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20100623/df86d17a/attachment.html>