On Wed, 22 Sep 1999, you wrote:
> I have found that people unknown are attacking my linux box! The following
> entries were found in maillog:
>
> Sep 15 07:09:07 C287853-A sendmail[1979]: NOQUEUE: [157.89.64.77]: VRFY
> guest
> Sep 15 07:09:07 C287853-A sendmail[1980]: NOQUEUE: [157.89.64.77]: VRFY
> decode
> Sep 15 07:09:07 C287853-A sendmail[1981]: NOQUEUE: [157.89.64.77]: VRFY bbs
> Sep 15 07:09:07 C287853-A sendmail[1982]: NOQUEUE: [157.89.64.77]: VRFY lp
> Sep 15 07:09:07 C287853-A sendmail[1983]: NOQUEUE: [157.89.64.77]: VRFY
> uudecode
> Sep 15 07:09:07 C287853-A sendmail[1977]: NOQUEUE: "wiz" command from
> [157.89.64.77] (157.89.64.77)
> Sep 15 07:09:07 C287853-A sendmail[1977]: NOQUEUE: "debug" command from
> [157.89.64.77] (157.89.64.77)
>
> (WHAT THE HELL IS THE "WIZ" COMMAND. AND THE "DEBUG" COMMAND!!
>
> Please! If anyone knows what this jerk is trying to do and How I can stop
> him PLEASE let me know!
This looks to me like someone has connected to port 25 (sendmail
port) with telnet and is issuing commands, which should do no harm
judging by the commands he tryed.
do nslookup IP# to see what his domain is.
> Thanks.
--
Regards Richard
[EMAIL PROTECTED]
