From owner-freebsd-questions@FreeBSD.ORG Fri Jan 23 06:39:30 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E1FE316A4DD for ; Fri, 23 Jan 2004 06:39:30 -0800 (PST) Received: from mta9.adelphia.net (mta9.adelphia.net [68.168.78.199]) by mx1.FreeBSD.org (Postfix) with ESMTP id B1FAA43D45 for ; Fri, 23 Jan 2004 06:39:27 -0800 (PST) (envelope-from fbsd_user@a1poweruser.com) Received: from barbish ([67.20.101.103]) by mta9.adelphia.net (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with SMTP id <20040123143921.NJCS27240.mta9.adelphia.net@barbish>; Fri, 23 Jan 2004 09:39:21 -0500 From: "fbsd_user" To: "Didier WIROTH" , Date: Fri, 23 Jan 2004 09:39:21 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <0HRY00B254QJOX@mail.etat.lu> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Subject: RE: log_in_vain="YES" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: fbsd_user@a1poweruser.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Jan 2004 14:39:31 -0000 Your problem conclusion sounds logical to me. I run postfix and firewall with log_in_vain option On my gateway system and do not get what you have. Can not help you in verifying the problem. It's not really an bug, just uncommon mix of system configuration options. Sendmail is functioning normally and so is log_in_vain. Since you have firewall up stream, you really have no need for the log_in_vain option. -----Original Message----- From: owner-freebsd-questions@freebsd.org [mailto:owner-freebsd-questions@freebsd.org]On Behalf Of Didier WIROTH Sent: Friday, January 23, 2004 9:11 AM To: freebsd-questions@freebsd.org Subject: RE: log_in_vain="YES" Thanks for answering. No actually I don't think someone is spoofing. There is a firewall (other machine, actually) blocking any kind of incoming&outgoing 127. adresses. So I don't think (at this time) that this is the problem. What I ment with cron, is that there are daily reports the are being sent via sendmail. I've this sendmail option in rc.conf: sendmail_enable="NO". Sendmail is only listening on localhost. I assume that my freebsd host sends a auth command to 127.0.0.1 because a sendmail connection is being tried from 127.0.0.1. The samples of my 127.0.0.1 entries corresponds exactly at the time, that the daily reports arrives. Perhaps someone could confirm this? -----Original Message----- From: fbsd_user [mailto:fbsd_user@a1poweruser.com] Sent: vendredi 23 janvier 2004 14:17 To: Didier WIROTH; freebsd-questions@freebsd.org Subject: RE: log_in_vain="YES" If this is happening while your system is connected to the public internet then your system is under attack by somebody who is spoofing ip address 127.0.0.1. Port 113 is the ident protocol. There is no reason for the cron jobs to be doing that. You should power off you system when not in use at least until you install an firewall software solution. You really need an firewall, and should use IPFILTER as it's stateful keep-state rules function work correctly. FBSD's ipfw stateful rules are broken when used with ipfw's divert/natd function. _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"