What is the purpose of port 1234/TCP running by 'systemd' with process id '1' on Ubuntu 20.04

When I used $ nmap 192.168.1.X it shows that 1234/tcp OPEN hotline is open.

I am running behind firewall ufw, and there is no rule for port 1234.

$ lsof -i showed that it is running by systemd with process-id 1.

After some searching I came across this link, which might be serious (Section from link below).

1234 tcp trojan KiLo, Ultors Trojan Trojans
1234 tcp hotline SANS
1234 tcp SubSevenJavaclient [trojan] SubSeven Java client SANS
1234 tcp UltorsTrojan [trojan] Ultors Trojan SANS

What is the purpose of this port? Should I be concerned?

Update: I did a bit further investigation. Below are my findings.

1. $ lsof -i | grep 1234 output:

systemd 1 root 57u IPv6 36160 0t0 TCP *:1234 (LISTEN) monopd 2154 nobody 3u IPv6 36160 0t0 TCP *:1234 (LISTEN) 

2. $ whereis monopd output:

monopd: /usr/sbin/monopd /etc/monopd.conf /usr/share/man/man6/monopd.6.gz 

3. $ man monopd output [partial]:

monopd(6) games monopd(6) NAME monopd - Monopoly™ like game server SYNOPSIS monopd DESCRIPTION monopd is a dedicated game server daemon for playing Monopoly-like board games like GtkAtlantic. Clients connect to the server and communicate using short commands and XML messages. 

4. $ cat /etc/monopd.conf output [partial]:

# Monopd configuration file. # # # Port which monopd should be listening to. # port=1234 # # Metaserver host. # metaserverhost=meta.atlanticd.net # # Metaserver port. # metaserverport=1240 

Further reading: monopd debian wiki

1 Answer

SOLUTION:

Removed monopd $ sudo apt remove monopd, which removed entry for port 1234 from $ lsof -i ouput.