Logged in to fortinet's base with the rsh command

milly · ‎06-09-2019

Hi all! When I monitor office fortigate 50e (v5.4.8,build1183GA), I often check the log that is logged in to fortinet's base with the rsh command. It is about 10 times a minute. Is this normal? Best regards

ede_pfau · ‎06-09-2019

I'd say no. What you can expect is attempts to the SSH port, and the HTTPS port, if you have mgmt ports open on the WAN port.

Might be you have RSH open on a VIP?

Ede

"Kernel panic: Aiee, killing interrupt handler!"

milly · ‎06-09-2019

Hi Ede! Thank you for your kind reply. I was surprised that It is using RSH. I am not opening RSH with VIP. Since the time when the management of the former office foritigate manager was not good for a long time, I confirm whether there is any trouble. Should I suspect the possibility of being a springboard? Best regards.

milly.