[Samba] Port 7

[Anthony Accurso]

On Mon, Sep 7, 2009 at 7:45 AM, Volker
Lendecke<Volker.Lendecke at sernet.de> wrote:
> On Mon, Sep 07, 2009 at 07:18:01AM -0500, Anthony Accurso wrote:
>> Output of "fuser 7/tcp" identifies PID 650.  Output of "ps 650"
>> identifies "/usr/sbin/smbd -D".  That's the hard way.  The easy way
>> was stopping Samba and watching port 7 close (via nmap).
>
> Wow, that's weird. Never seen that. I would *love* to log
> into that box....
>
> Volker
>
I'm not about to open the box up for international inspection.  This
all started when I decided I wanted to harden my system a bit by
closing unnecessary ports.  I was hoping at least that I wasn't the
only one that had noticed this behavior.  I don't want to have to
resort to blocking incoming access via iptables because that's just
patching the problem and not a true solution.  Maybe someone knows
where Samba would log this kind of behavior and its cause?