Re: finding a process that bind a spcific port

[Nicolas Rachinsky <deb-security-1@ml.turing-complete.org>]

* emmanuel segura <emi2fast@gmail.com> [2014-01-22 15:06 +0100]:
> if you think you are been hacked, you can use ps, lsof and others commands
> from other not hacked server, for example scp goodserver:/bin/ps /tmp/ps
> and use /tmp/ps, this isn't secure, because maybe the attacker installed
> one rootkit

If you have used the password for goodserver, then the attacker may
now have this as well. Or the passphrase to your key. If you do not
need any of these, the goodserver might not be that good.

Nicolas