I've done some hardening, added a bunch of rules to my firewall, removed NTP permissions and restricted port 123. But now I get a weird entry in my lsof command when looking at running connections.
flossco@flossco-mypc:/etc$ sudo lsof -i -n -P
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
master 1486 root 12u IPv4 20915 0t0 TCP 127.0.0.1:25 (LISTEN)
whois_psa 4054 root 3u IPv4 99211 0t0 TCP <myip>->202.12.29.220:43 (SYN_SENT)
How do I find out who is this user whois_psa is and what they are doing with my connections? My username is flossco and prior logs were in my name - what changed? I can't find anything re this on internet. This is part of my attempt to harden my linux against recent attacks. I don't know if this is ok or not.
whois_psa
is the command. The user isroot
.