From owner-freebsd-questions  Mon Jul 30 11:34:35 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from web12801.mail.yahoo.com (web12801.mail.yahoo.com [216.136.174.36])
	by hub.freebsd.org (Postfix) with SMTP id C836737B403
	for <questions@freebsd.org>; Mon, 30 Jul 2001 11:34:32 -0700 (PDT)
	(envelope-from zaunere@yahoo.com)
Message-ID: <20010730183432.98150.qmail@web12801.mail.yahoo.com>
Received: from [128.122.155.151] by web12801.mail.yahoo.com; Mon, 30 Jul 2001 11:34:32 PDT
Date: Mon, 30 Jul 2001 11:34:32 -0700 (PDT)
From: Hans Zaunere <zaunere@yahoo.com>
Subject: RE: Spoof attack?
To: Yonatan Bokovza <Yonatan@xpert.com>, questions@freebsd.org
In-Reply-To: <EB513E68D3F5D41191CA00025558810150D594@mailserv.xpert.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG


Ok, that sounds reasonable.  However, sendmail is not
running.  Its a very stripped down system, with
nothing running except ssh.  The only thing I could
think of is my periodic security mailings from cron,
which I get in my root box.  However, if I dont have
sendmail running, how am I getting these?  Also, can
these be sent somewhere else (externally), even
without me running sendmail?

Thank you,

Hans
zaunere@yahoo.com


--- Yonatan Bokovza <Yonatan@xpert.com> wrote:
> Hi,
> 
> > I have tcp and udp log_in_vain options enabled in
> my
> > kernel.  I have noticed a couple odd connection
> > attempts:
> > 
> > Connection attempt to UDP 127.0.0.1:512 from
> > 127.0.0.1:1131
> 
> sendmail tries to access a local service called
> "comsat",
> on port 512/udp.
> A workaround is to comment this line in
> /etc/services:
> biff	512/udp	comsat
> There is probably something you can configure in
> sendmail to fix this.
> Kudos for your paranoia. Keep that up.
> 
> Best Regards, 
> 
> Yonatan Bokovza
> IT Security Consultant
> Xpert Systems
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of
> the message


__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message