who is doing remshd?

[someone_4]

Hey everyone I have attached a portion of my wtmp log. And as you see someone is doing a remsh every second 24 hours a day. I have asked around and no one is doing that many. Is there any way that I can find out an ip of where the remsh is comming from? Or does anyone have any suggestions to find out who and what is doing this?

Thanks

Richard

[James R. Ferguson · Accepted solution]

Hi Richard:

Probably the easiest way to find out "who" is doing this is to enable connection logging:

# /usr/sbin/inetd -l

This is a toggle to turn logging on as well as off. The logging is done in /var/adm/syslog/syslog.log by default.

Regards!

...JRF...

[A. Clay Stephenson]

Hi Richard,

The easist method is to do an lsof | grep remshd | grep TCP

This will list the connected ports and the IP Address or Hostname of the offender.

It may take several tries to get it since whatever this is, it appears to be a very quick process. If you don't have lsof, you can download it from one of the HP-UX Porting Centers and it is a utility you should always have.

Clay

[Dan Bonham]

You could take a more brutal approach and turn remsh off in the inetd.conf file, run inetd -c to re-read the configuration file and then wait and see if anyone calls to complain.

[someone_4]

Hey Mr. James
That worked great.

Mr Clay ..
If you reccomend lsof that is a tool I will look into.

Rusy ..
sorry I cant do that .. phone would ring of the hook but fun thought.

Richard