> Yo;
>       Once again, another question to be applied on my Mandrake 9.2 server 
> box,
> which you're probably starting to become friends with.  I leave KDE System
> Guard open at times on my SuSE box monitoring the Mandrake server
> remotely.
> I've noticed that a TCP connection opens occasionally, connected to from
> hosts all around the world (China, UK, u-name-it) to a "netbios-ssn"
> socket.
> What's happening here? What's netbios-ssn?  All I'm running is a website
> for
> a local buisness at the moment... I can't imagine why peeps from China and
> the UK would want to access this server... are these crackers? Do I have a
> clue what I'm talking about?
>                   Thanx,
>                          ES
>
First thing - it doesn't sound like you are running a firewall on that
box.  You should be running one on ANY machine connected to the Internet. 
You can open a hole in the firewall for the web server, and still block
everything else.

Now, as for what you are seeing, it is someone looking to see what windows
file sharing shares your box has.  They are looking for windows machines
that have file/print sharing enabled, and no firewall.  If this were a
Windows machine, they could then access those files, and possible write
new files to the system.  It depends on how file sharing is set up.  The
same thing can also be done to a Linux box running Samba.  (You can set
other protections in Samba, that you can not in Windows file sharing, but
that is besides the point...)  Windows boxes that can be accessed this way
are a tempting target because chances are they don't have the latest
security updates, and because the owner of the box doesn't know security. 
A Linux box with these ports open is also a targer, because the ports
should not be open on a properly secured box.

Do us all a favof, and check out Shorewall, or another firewall setup
program.  Shorewall is included with 9.2, and is not that hard to set
up...

Mikkel


____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________

Reply via email to