1

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc.

I'm use to seeing heaps of Inbound blocks from hackers etc. but seeing the below outbound block & appreciate suggestions on where to look to try & discover what is causing this traffic.

Sep 26 12:40:28 thor kernel: Firewall: *TCP_OUT Blocked* IN= OUT=eth0 SRC=xx.xx.xx.xx DST=54.241.137.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54974 DF PROTO=TCP SPT=49907 DPT=31000 WINDOW=14600 RES=0x00 SYN URGP=0 UID=509 GID=509

My server XX is the SRC source IP & destination IP seems to belong to Amazon web services.
The UID GID listed in log is that of user with hosted website but cant see anything obvious in site. I presume there must be some kind of script trying to contact AWS.

2

How I resolves this just incase it may be helpful to anyone.

After some reading/googling I used the below to track down the source of outbound packets that were been blocked.

UID is mentioned in the Firewall log UID=509

awk -v val=509 -F ":" '$3==val{print $1}' /etc/passwd

This gave the user name, I then did a grep on user account for amazon, as IP belonged to amazon AWS

grep -r amazon /home/username

There was a bit of data to go thru so piped it to a file for further perusal.

grep -r amazon /home/username >/home/filename

WARNING make sure you don't save file to same dir you are grepping or you will get an infinite growing file.

Turned out to be a WordPress plugin, updraftplus, trying to backup users website to amazon cloud on a blocked outbound port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.