Hello,
When I display sockstat listen command I can see a very different user SS listed on a list of active services.
I scanned the system using chkrootkit to look for a potential rootkit, but nothing has been found. What might be that? Is this a correct and valid state of running FreeBSD 12.1 server installation?
The user is listed, but it has no command and no PID. I also don't see any user like that in my /etc/passwd. After reboot process sometimes disappear and I don't always see SS on the list of running services. The kernel level security is 3.
I also checked different FreeBSD 12.1 installation on VirtualBox and I don't have SS user on sockstat -4 -l list.
What is SS? Should I care? What tools do you use to scan for rootkits beside a chkrootkit (maybe it is outdated and should not be used in 2020)?
Regards,
Marcin
When I display sockstat listen command I can see a very different user SS listed on a list of active services.
Code:
# sockstat -4 -l
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
SS
proxy ftp-proxy 67974 3 tcp4 127.0.0.1:8021 *:*
(... more services below ...)The user is listed, but it has no command and no PID. I also don't see any user like that in my /etc/passwd. After reboot process sometimes disappear and I don't always see SS on the list of running services. The kernel level security is 3.
I also checked different FreeBSD 12.1 installation on VirtualBox and I don't have SS user on sockstat -4 -l list.
What is SS? Should I care? What tools do you use to scan for rootkits beside a chkrootkit (maybe it is outdated and should not be used in 2020)?
Regards,
Marcin
Maybe the question should be deleted because it's too trivial.