Dears, I wanted to ask if anybody has details on why python is listening to port 8000 (local and remote connections as well). Can it be a backdoor ? I tried to telnet to the ip/port and the connection is accepted. Thanks in advance!
I run sudo lsof -i tcp:8000, and it yelded:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ajenti-pa 3598 root 8u IPv4 10912 0t0 TCP li499-163.members.linode.com:8000 (LISTEN)
I see Ajenti (some kind of admin panel) listening. I will try to find out more. Thank you.
1 Answer
Find out which program has the port open with
sudo lsof -i tcp:8000
Foe example, since I know I'm running sshd, I'll check for port tcp:22 here:
$ sudo lsof -i tcp:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1617 root 3u IPv4 14360 0t0 TCP *:ssh (LISTEN)
sshd 1617 root 4u IPv6 14362 0t0 TCP *:ssh (LISTEN)
Of course, read man lsof BEFORE you execute the command. After all, I could be wrong or misleading.
Then, you can use ps to investigate the process with that PID, or inspect the /proc/PID/ directory. The possibilities expand from here.
