SUSPICOUS: SMTP service on my box

Tech Support Forum Linux, BSD and Other OS's
1

Hey all,

I was very surpriesed today to see smtp running on my computer! i don’t remember installing it directly with apt… it might have been requried by somethig else, but i don’t really remember seeing it anywhere, but, i have been drunk while in charge of my computer! (and staying up stupidly early [6AM] just because i don’t feel like sleeping]

The smtp service only seems to be accessable localy, nmap only shows it when i scan the machine from the machine (nmap -sS -p1-65535 localhost)

advice? i want to know how it got there! The only other service i have running is SSH (world accessable) [but i do have a fairly sizeable password]

2

Most distros run an SMTP daemon on loopback for internal mailing (between users on the same system) and for sending logs. What distro are you running? Also, which SMTP daemon is running?

3

Ubuntu 7.04… how do i identify the deamon that owns the port?

4 
netstat -p
5 
sudo netstat -p -l

Gave me

tcp 0 0 *:smtp : LISTEN 4584/exim4

6

Totally normal. Exim is the sendmail replacement on Debian and derivative systems. It’s installed by default as your system mailer, but forbidden from sending, receiving or relaying for outside hosts.

7

Thanks :slight_smile:

8

No problem. :slight_smile: