Re: about nmap

> When I find something open and check
> it again, it is closed. And... cannot
> close "syslogd" for report issues.

At least, can not you run syslogd with syslogd_flags="-ss" in /etc/rc.conf ?
It disables listening on 514 at all, but still works locally.
Do not use it, if your machine is used as syslogd "file server" for other
machines !

And what about some milter ? It could open some local connections on high
ports. Do not you have some kind of antispam system on your machine ? Or
DansGuardian or something like ?

Have you tried to run "sockstat >> /some/file" every minute from cron and
try to find which process opens the port ?

Peter Rosa

_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"