2

I have an EC2 instance running a postfix-dovecot email server. I use an AWS security key to access this EC2 and I consider the security pretty tight.

When I run: systemctl list-units --type service --all

I see these suspicious looking entries on the list:

UNIT                           LOAD      ACTIVE   SUB     DESCRIPTION
ΓùÅ auditd.service             not-found inactive dead    auditd.service
ΓùÅ connman.service            not-found inactive dead    connman.service
ΓùÅ console-screen.service     not-found inactive dead    console-screen.service
ΓùÅ display-manager.service    not-found inactive dead    display-manager.service
ΓùÅ exim4.service              not-found inactive dead    exim4.service
ΓùÅ fcoe.service               not-found inactive dead    fcoe.service
ΓùÅ iscsi-shutdown.service     not-found inactive dead    iscsi-shutdown.service

My server is running: Spamassasin, Clamav, Spamass-milter and AppArmor

My server only allows authenticated access on SSL/TLS via a domain certificate signed by a trusted certificate authority. It does not allow mail to sent from unknown domain users or unknown clients.

Open ports on my EC2 security group for any IP address:
HTTP    80
HTTPS   443
IMAP    143
IMAPS   993
SMTPS   465
SMTPS   587
MYSQL   3306

Custom services 7500,8001,8002,8003,8080,8444,8443

SSH 22 Restricted to specific IP addresses

I can see these suspicious service entries are not running. I want to please know:

  1. What does it mean?
  2. What has happened and is it malicious?
  3. How does it affect my server?
  4. What action should I take?

2 Answers 2

5

Those are special characters, and for whatever reason they are not displaying properly on whatever display device you are using. On my PuTTY SSH session to my server, they show as a yellow large dot. In the Ubuntu Serverguide, we have to manually change those characters to just a period, in order to satisfy our no non ACSII characters requirement in the master English code.

There is nothing else wrong with your system.

4
  • Relief, thank you. What action should I take? Oct 24, 2018 at 15:03
  • 1
    You don't need to take any action. I have the same, or at least similar list. I suspect the list is some generic list, and some things are not installed on servers or some flavors of Ubuntu. Oct 24, 2018 at 15:07
  • All of the services with this anomoly have a status of "dead". Some of the services look like they could be important like systemd-sysusers.service. Should I not attempt to repair and restart these services? Oct 24, 2018 at 15:12
  • Please see follow up question askubuntu.com/questions/1087227/dead-references-in-service-list Oct 25, 2018 at 18:46
1
ΓùÅ auditd.service             not-found inactive dead    auditd.service

systemctl is trying to display coloured warning dots, but you have banjanxed it by not using a terminal that decodes UTF-8.

The services themselves are not-found. This is most likely because they are dangling references from other service units, named in their dependencies or orderings, with no service unit files existing for them.

It is not compulsory to satisfy such dangling references. Far from it.

2
  • Thank you JdeBP, this makes sense because the excerpts above was when using a Putty client on my windows machine but when I view the same list from my MAC terminal I can see the dots you are referring to. Although I have been in IT for a long time, I am fairly new to using Linux. I am at ease that my server is not compromised but fact that you refer to them as dangling references triggers my spider-sense to take action in resolving the dangly-ness. Although I am not sure what it is exactly, I will use the info from this question to post a new question asking this. Thanks again. Oct 25, 2018 at 18:32
  • Please see follow up question askubuntu.com/questions/1087227/dead-references-in-service-list Oct 25, 2018 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.