From owner-freebsd-security Mon Feb 4 11:14:53 2002 Delivered-To: freebsd-security@freebsd.org Received: from dc.cis.okstate.edu (dc.cis.okstate.edu [139.78.100.219]) by hub.freebsd.org (Postfix) with ESMTP id 080B837B400 for ; Mon, 4 Feb 2002 11:14:45 -0800 (PST) Received: from dc.cis.okstate.edu (localhost.cis.okstate.edu [127.0.0.1]) by dc.cis.okstate.edu (8.11.6/8.11.3) with ESMTP id g14JEiM74583 for ; Mon, 4 Feb 2002 13:14:44 -0600 (CST) (envelope-from martin@dc.cis.okstate.edu) Message-Id: <200202041914.g14JEiM74583@dc.cis.okstate.edu> To: freebsd-security@FreeBSD.ORG Subject: Re: Port 113 Traffic Date: Mon, 04 Feb 2002 13:14:44 -0600 From: Martin McCormick Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Thank you to all of you who have answered. One of the first things I did was to look in /etc/services which is what I usually do if there is a question about what this or that port is used for and it did show up as auth, all right. A man on auth yielded the auth_getval function in C and not much else so I knew it was some kind of authorization engine and that's where my trail ran a bit cold. I checked out ident and learned what rcs is for, but never found any reference to auth so I greatly appreciate the information that links it with sendmail, etc. I may block it experimentally and see if anything does break since I have ipfw running and it is a simple matter to add a new rule or remove it later. Sendmail is the only service I am running that I might break by closing that port so I will close it and see if sendmail still runs. Martin Andrew Kenneth Milton writes: >113 is the ident/auth port. > >There are a number of things that query the ident port, IRC servers, >sendmail, and squid to name a few. It's probably nothing to be worried about. > >If you block it and something stops working, I'm sure someone will scream >at you d8) > >-- >Totally Holistic Enterprises Internet| | Andrew Milton >The Internet (Aust) Pty Ltd | | >ACN: 082 081 472 ABN: 83 082 081 472 | M:+61 416 022 411 | Carpe Daemon >PO Box 837 Indooroopilly QLD 4068 |akm@theinternet.com.au| > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message