strange command by root user whois_psa when run lsof command ubuntu 16.04

Question

I've done some hardening, added a bunch of rules to my firewall, removed NTP permissions and restricted port 123. But now I get a weird entry in my lsof command when looking at running connections.

    flossco@flossco-mypc:/etc$ sudo lsof -i -n -P
    COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    master    1486 root   12u  IPv4  20915      0t0  TCP 127.0.0.1:25 (LISTEN)
    whois_psa 4054 root    3u  IPv4  99211      0t0  TCP <myip>->202.12.29.220:43 (SYN_SENT)

How do I find out who is this user whois_psa is and what they are doing with my connections? My username is flossco and prior logs were in my name - what changed? I can't find anything re this on internet. This is part of my attempt to harden my linux against recent attacks. I don't know if this is ok or not.

Answer 1

I've found out this command was associated with psad , a strange subdirectory whois_psad but doesn't seem to be part of the regular directory and command. I removed the associated files and haven't had the user come up since.