Re: what is means ?

["Joe Moore" <joemoore@iegrec.org>]

> In output of 'w' command I saw something like that:
> 
> --cut--
> root      7073  0.0  0.0  1240  636 ?        S    11:09   0:05
> in.telnetd: some.host.in.my.domain --cut--
> 
> Correct address I replaced with some.host.in.my.domain.
> Is root is logging to this mashine by telnet ???

Maybe, but probably not.

If you had done a "px axfl" (output trimmed below) and looked at process
7073 and its children, you probably would have seen something like this:
UID   PID  PPID PRI  NI   VSZ  RSS  TTY        TIME COMMAND
  0   322     1   0   0  2028  740    ?          0:02 /usr/sbin/inetd
  0  9308   322   0   0  1492  712    ?          0:00  \_ in.telnetd
481  9309  9308  10   0  2248 1300  pts/6      0:00      \_ -bash

in.telnetd may be run with root privs, in order to set up the login
environment for the user.  It does not mean that someone is telnetting in as
root.  By default in testing, in.telnetd runs as user "telnetd" (uid 103)
rather than root.

--Joe


-- 
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org