I've done some hardening, added a bunch of rules to my firewall, removed NTP permissions and restricted port 123. But now I get a weird entry in my lsof command when looking at running connections.

    flossco@flossco-mypc:/etc$ sudo lsof -i -n -P
    master    1486 root   12u  IPv4  20915      0t0  TCP (LISTEN)
    whois_psa 4054 root    3u  IPv4  99211      0t0  TCP <myip>-> (SYN_SENT)

How do I find out who is this user whois_psa is and what they are doing with my connections? My username is flossco and prior logs were in my name - what changed? I can't find anything re this on internet. This is part of my attempt to harden my linux against recent attacks. I don't know if this is ok or not.

  • whois_psa is the command. The user is root.
    – AlexP
    Jan 4, 2017 at 11:03
  • thanks @AlexP I've now corrected this in an edit. Is this a common command. I cant find it anywhere. How can I disable?
    – user637251
    Jan 4, 2017 at 11:31

1 Answer 1


I've found out this command was associated with psad , a strange subdirectory whois_psad but doesn't seem to be part of the regular directory and command. I removed the associated files and haven't had the user come up since.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.