From owner-freebsd-security  Mon Dec  3  5:25:57 2001
Delivered-To: freebsd-security@freebsd.org
Received: from promavto.ru (quadrus.niit.ru [212.5.121.43])
	by hub.freebsd.org (Postfix) with ESMTP id 05B9737B417
	for <security@freebsd.org>; Mon,  3 Dec 2001 05:25:54 -0800 (PST)
Received: (from root@localhost)
	by promavto.ru (8.9.3/8.9.3) id QAA03612
	for security@freebsd.org.AVP; Mon, 3 Dec 2001 16:25:53 +0300 (MSK)
	(envelope-from jhvhs@promavto.ru)
Received: from jhvhs (jhvhs.quadrusm.ru [192.168.43.67])
	by promavto.ru (8.9.3/8.9.3) with SMTP id QAA03596;
	Mon, 3 Dec 2001 16:25:51 +0300 (MSK)
	(envelope-from jhvhs@promavto.ru)
Reply-To: <jhvhs@promavto.ru>
From: "Konstantin V. Semenov" <jhvhs@promavto.ru>
To: "'David Wolfskill'" <david@catwhisker.org>
Cc: <security@freebsd.org>
Subject: RE: What could be doing this?
Date: Mon, 3 Dec 2001 16:26:20 +0300
Message-ID: <009401c17bfe$18d75780$432ba8c0@quadrusm.ru>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="koi8-r"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0)
In-Reply-To: <200112031301.fB3D11R29046@bunrab.catwhisker.org>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Importance: Normal
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


> It's probably not as "random" as you think:  I suspect it corresponds
> with what SMTP servers to which you try to send mail.  It is 
> common for
> an SMTP server to do an IDENT query to an SMTP client.
> 

So it's just someone trying to send mail through my machine?
I have restricted SMTP from the ${oif}.
So it must log deny port 25 attempts and never try to identify
the client. Am I wrong?

  Kind regards,


     Konstantin V Semenov aka JHVHS
                                        jhvhs@quadrus.ru

		PromAvtoContract plc.   http://www.promavto.ru




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message