On Sun, Jan 12, 2003 at 09:08:41PM -0500, Mark Weaver wrote: > On Sunday 12 January 2003 08:42 pm, [EMAIL PROTECTED] scribbled incoherently: > > All; > > Ok, I'm ready to dump the whole thing in the bay. I have a server gone > > mad. > > > > After a power failure, the server came back in a very unstable state. So > > far, any efforts to fix it, seem to only make it worse. Every time I > > think I have it fixed, something else seems to go wrong. > > > > As it stands, "most" everything seems to be working, except mail. Im > > running imap on it. Any effort to check the mail, from either inside, or > > outside the lan results in the address of the host checking the mail > > getting blocked. The following lines get added to /var/log/messages > > > > Jan 12 16:29:36 ibu portsentry[2696]: attackalert: TCP SYN/Normal scan > > from host: chantika.keluarga.lan/192.168.100.3 to TCP port: 143 > > Jan 12 16:29:36 ibu portsentry[2696]: attackalert: Host 192.168.100.3 > > has been blocked via wrappers with string: "ALL: 192.168.100.3" > > > > Can anyone shed some light on what's causing any effort to check the > > mail to be interpreted as an SYN attack? > > > > in short: HELP!!!!! > > > > THanks!! > > > > Ric > > Hi Ric, > > The very first thing I'd do is turn PS completely off. Better yet...just take > the little bugger outa there cause in the long run that app is more trouble > at times then it's worth. Once that thing isn't present to muck up the works > you may have an easier time debugging the situation. > > I was running into that for a while some time back and got so sick of PS doing > that very thing to me I just took it out. I've not been having any troubles > like it since. And I'm still able to keep track of connections to the box > just as well. It just gets done a little differently now. > -- > Mark
Hi Mark; Thank you for the reply. Ok, I just shut off portsentry (service portsentry stop). Bastille-firewall is still running. (I'm open to suggestions on better firewalls... Been running Bastille for a while now. Never had any problems in the past. But this one is hair puller.. Ok, so after shutting down portsentry, I still can't get my e-Mail. I get a "Failure to connect to server" error at the client end. Nothing in the logs on the server. imap is listed in the Bastille config file. But the port seems blocked. If it's not bastille, what is it? Ric
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
