Security

Ask something
Discussion Locked

nfs problem and zombe

0 helpful
3 replies

by ghassans

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

hi
i want to ask about the nfs problem what i can do with it ? and how i can kill zombis

thanks

3 replies

by infosecgeek

As you did not give details about your
system I will try to guess your problem.

I guess that you have a Linux machine that
has all RPC services open as installed by default and so it is vulnerable to many attacks that exploit vulnerabilities onport 111.

If you do not need to use NFS, the best way
to avoid any problems with it is to disable the RPC services such as : portmap, nfs, rpc, etc.

In Red Hat Linux you can do that simply
logging in as root and typing : setup.
Then look for menu item System Services
scroll down to find portmapper and nfs
and disable the services by pressing the
space bar until the asterisk is gone.

Then reboot the machine, login as root
and type: netstat -an |more and see if
TCP port is listed as "listening". If
it?s not, then you can proceed to clean
any worm related to NFS.

In the following URL you will find more guidance on how to proceed if your system
is compormised using trojans, zombies or rootkits.
----------------------------------------
http://www.cert.org/tech_tips/win-UNIX-system_compromise.html
----------------------------------------

I hope I helped, otherwise please give some
more details about your config.

Cheers.

This discussion is closed to new replies.