From owner-freebsd-isp Sat Jul 8 17:16:28 2000 Delivered-To: freebsd-isp@freebsd.org Received: from server.comnix.com (ns1.comnix.com [195.196.30.50]) by hub.freebsd.org (Postfix) with SMTP id BBFEC37B50C for ; Sat, 8 Jul 2000 17:16:23 -0700 (PDT) (envelope-from john@veidit.net) Received: (qmail 31656 invoked from network); 9 Jul 2000 00:16:19 -0000 Received: from t6o41p33.telia.com (HELO sandra) (195.67.253.93) by ns1.comnix.com with SMTP; 9 Jul 2000 00:16:19 -0000 Message-ID: <000e01bfe93a$e79c0500$5dfd43c3@sandra> From: "John Angelmo" To: , References: <200007081646540580.0158100A@web4.allunix.com> Subject: Re: port 113(hack attack?) Date: Sun, 9 Jul 2000 02:16:17 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hmm I have the same ting but the only one that tries to access me there = is my DNS server.. don't see a problem with that check if those IPs are = you DNS.. /John ----- Original Message -----=20 From: David W. DeTinne=20 To: freebsd-isp@freebsd.org=20 Sent: Sunday, July 09, 2000 1:46 AM Subject: port 113(hack attack?) I have log_in_vain set in my rc.conf file. Ever since doing this I have = witnessed all sorts of connection attempts to port 113, here are some examples; Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2132 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2133 Connection attempt to TCP 24.11.229.88:113 from 130.236.254.50:61744 Connection attempt to TCP 24.11.229.88:113 from 130.236.254.50:61746 Connection attempt to TCP 24.11.229.88:113 from 131.220.43.1:3056 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2211 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2228 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2229 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2234 Connection attempt to TCP 24.11.229.88:113 from 216.190.128.200:2250 Connection attempt to TCP 24.11.229.88:113 from 209.161.0.33:2966 Connection attempt to TCP 24.11.229.88:113 from 203.178.141.212:4723 The /etc/services file states that port 113 is used for a Authentication = Service? My question is, what is happening here, is someone trying to access my = system or is this normal?=20 Thank You, David DeTinne To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message