From owner-freebsd-questions@FreeBSD.ORG Sat Feb 25 15:46:13 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 970DE16A420 for ; Sat, 25 Feb 2006 15:46:13 +0000 (GMT) (envelope-from dead_line@hotmail.com) Received: from hotmail.com (bay20-f1.bay20.hotmail.com [64.4.54.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6B4BA43D45 for ; Sat, 25 Feb 2006 15:46:13 +0000 (GMT) (envelope-from dead_line@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Sat, 25 Feb 2006 07:46:12 -0800 Message-ID: Received: from 62.150.203.66 by by20fd.bay20.hotmail.msn.com with HTTP; Sat, 25 Feb 2006 15:46:08 GMT X-Originating-IP: [62.150.203.66] X-Originating-Email: [dead_line@hotmail.com] X-Sender: dead_line@hotmail.com From: "The Happy" To: freebsd-questions@freebsd.org Date: Sat, 25 Feb 2006 15:46:08 +0000 Mime-Version: 1.0 Content-Type: text/plain; format=flowed X-OriginalArrivalTime: 25 Feb 2006 15:46:12.0931 (UTC) FILETIME=[9AEF4930:01C63A22] Subject: Is it hack? How to prevent! X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2006 15:46:13 -0000 Hello everyone, I'm on freebsd 4.8R acting as a webserver and email server, I keep getting In my /var/log/messages a strange 3 type of messages, 1) mysqld[8541]: error: /etc/hosts.allow, line 212: twist option in resident process last message repeated 73 times 2) inetd[50977]: warning: /etc/hosts.allow, line 25: host name/address mismatch: 208.34.235.251 != mail.nrms.org 3) sshd[40712]: warning: /etc/hosts.allow, line 25: can't verify hostname: getaddrinfo(na-163- 219.na.avantel.net.mx, AF_INET) failed (I keep getting differnt host everytime) about messages 2 and 3 i think its some hacks attempts How i can preven this type of access? unmatched IPs? what about messages number 1? what doest mean is it hack attempt? My logs are full of these messages, please help Note line 25 in /etc/hosts.allow is ALL : .temma.net : deny and has nothing to do with these logs its just the first rule in the file. Thank you in advance. Marwan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/