What was working on one server was not working on another, seems portsentry had been installed in two places for some reason + when changing options logsentry was not mailing me the
'closing down' and 'starting to monitor ports xxx' messages ???
Just for the archive if anyone has this problem.
Portsentry - Config Changes
---------------------------
- Edit portsentry.conf
- ps -axwf
(
- get list of running portsentry processes
- ensure there are no duplicates, if so check the path for each one!
- kill the portsentry processes making a note of what type are running
- usr/xxx/yyy/portsentry -tcp
- restart portsentry processes that were running
- check logs or logcheck output to see portsentry coming up list of monitored ports.
)
From: Charlie Clemmer <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Re: [cobalt-security] Portsentry - config changes, help needed! Date: Sat, 18 Jan 2003 00:59:34 -0600-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 07:14 AM 1/18/2003 +0100, Audric Leperdi wrote: >look into your cron dirs (/etc/cron*) for a symbolic link to >logcheck and remove it. Logcheck and Portsentry, while both products of Psionic, have nothing to do with each other. I don't think a problem with Portsentry is going to be tracked back to Logcheck. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPij7YStTL7LSInmsEQIOLwCfRRe5KVd/B1R1fHxvlo/M4KWO2M8AoMGU 6fP4BmL5e8unxIMniwKjqhpI =czt6 -----END PGP SIGNATURE----- _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE* http://join.msn.com/?page=features/virus
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
