Date: Tue, 15 Jun 1999 08:55:49 -0600 (MDT) From: David G Andersen <danderse@cs.utah.edu> To: mjoseff@retribution.net (Matthew Joseff) Cc: freebsd-security@FreeBSD.ORG Subject: Re: /var/log/messages Message-ID: <199906151455.IAA19354@lal.cs.utah.edu> In-Reply-To: <Pine.BSF.4.10.9906150917490.14540-100000@retribution.net> from "Matthew Joseff" at Jun 15, 99 09:25:56 am
next in thread | previous in thread | raw e-mail | index | archive | help
Since nobody has pointed it out yet, just FYI, this is typically an
indication that you're being portscanned by the host 193.221.47.155.
You might also want to check for telnet connections, NOQUEUE messages from
sendmail, etc., to get a better idea of what they scanned.
Then, contact postmaster@molnycke.se about it (or, if that fails, they
list their domain contact as hostmaster@sgn.sca.se).
-Dave
Lo and behold, Matthew Joseff once said:
>
>
> Found this in my "messages" this morning:
>
> Jun 15 07:18:51 retribution rshd[19891]: connection from 193.221.47.155 on
> illegal port 1574
> Jun 15 07:18:51 retribution rlogind[19890]: Connection from 193.221.47.155
> on illegal port
>
> questions:
>
> 1) What can I do to avoid this?
> 2) Can any *real* damage be done from someone connecting like this?
> 3) What liabilities does this open the "offending" party's company to?
>
> --
> Matthew Joseff, Sr. Web Developer
> RCN Corp. 703-321-2410
> www.rcn.com NASDAQ: RCNC
>
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>
--
work: danderse@cs.utah.edu me: angio@pobox.com
University of Utah http://www.angio.net/
Computer Science - Flux Research Group "What's footnote FIVE?"
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199906151455.IAA19354>