Re: inetd Messages

Alan Cox (alan@cymru.net)
Thu, 21 Mar 1996 10:17:03 +0000 (GMT)

> Anybody finding these messages in their syslog, or the nmbd program in
> their /etc/inetd.conf file should IMMEDIATELY shut down inetd, remove the
> line concerning nmbd, and check their nmbd file size. I'm not sure if
> there is a legitimate program out there named nmbd, but that is one of

Yes. Its the netbios name server.

> the back doors that was installed in my system a few weeks ago. It
> allowed anyone telnetting to port 41 the ability to reboot or shutdown my
> machine! The file size on my machine was approxiamately 4K (I'm not sure

Port 41 isnt nmb. That sounds like someone installed a port of the KA9Q
remote reboot daemon on your box.

Alan