Why is python listening on port 8000?

Dears, I wanted to ask if anybody has details on why python is listening to port 8000 (local and remote connections as well). Can it be a backdoor ? I tried to telnet to the ip/port and the connection is accepted. Thanks in advance!

I run sudo lsof -i tcp:8000, and it yelded:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ajenti-pa 3598 root 8u IPv4 10912 0t0 TCP li499-163.members.linode.com:8000 (LISTEN) 

I see Ajenti (some kind of admin panel) listening. I will try to find out more. Thank you.

1 Answer

Find out which program has the port open with

sudo lsof -i tcp:8000

Foe example, since I know I'm running sshd, I'll check for port tcp:22 here:

$ sudo lsof -i tcp:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1617 root 3u IPv4 14360 0t0 TCP *:ssh (LISTEN)
sshd 1617 root 4u IPv6 14362 0t0 TCP *:ssh (LISTEN)

Of course, read man lsof BEFORE you execute the command. After all, I could be wrong or misleading.

Then, you can use ps to investigate the process with that PID, or inspect the /proc/PID/ directory. The possibilities expand from here.