Re: rant list

[Tighe Schlottog <emry@icephyre.net>]

> Ok, could someone throw me a bone here I'm getting stumped and glassy
> eyed, hopefully I'm missing something obvious, while I've been loading
> this new server (which would have been a lot easier with backups or at
> least install disks), I've been digging through the compromised server,
> even after replacing inetd with a clean copy and removing all entry's
> for httpd in inetd.conf and services then restarting using the clean
> inetd, nmap is still showing port 80 as open, it should be, you can't
> hit the web page (I also did a killall httpd), so am I missing
> something, why can't I shut down this port???

run this:

lsof | grep 80

Should report back what is bound to port 80.  Have you tried netstat -a
--inet?

Tighe

-- 
Tighe		w00t		blumnky
	"I am anger incarnate."
	"Oh yeah?  I toss poo."


-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.