I am performing a quick audit of services listening on external interfaces on a Ubuntu 14.04 machine, and tmux is binding TCP *:50994 and *:59147 as reported by netstat -l.
I can connect to this port from another computer on the network (barring any firewall settings), but I can't find any documentation about why it's binding an external port. What is the purpose of this and is there a way to stop it?
It is tmux and it is a Unix socket. Tmux apparently uses server sockets to allow for independent tmux servers to be run. man tmux
Run tmux with no flags
tmux
$ ss -l |grep tmux
u_str LISTEN 0 128 /tmp/tmux-1000/default 62749 * 0
Then run tmux with -S /tmp/tmux.sock and see that the change in the socket path.
$ ss -l |grep tmux
u_str LISTEN 0 128 /tmp/tmux.sock 62765 * 0
Note, It is not TCP. This can be seen from using the flags -t (tcp) and -l (listening)
$ ss -tl
(returns no lines but the headers)
are you using tcsh? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204429 has a similar-ish problem where starting tmux on tcsh results in dns queries.
