> Yo; > Once again, another question to be applied on my Mandrake 9.2 server > box, > which you're probably starting to become friends with. I leave KDE System > Guard open at times on my SuSE box monitoring the Mandrake server > remotely. > I've noticed that a TCP connection opens occasionally, connected to from > hosts all around the world (China, UK, u-name-it) to a "netbios-ssn" > socket. > What's happening here? What's netbios-ssn? All I'm running is a website > for > a local buisness at the moment... I can't imagine why peeps from China and > the UK would want to access this server... are these crackers? Do I have a > clue what I'm talking about? > Thanx, > ES > First thing - it doesn't sound like you are running a firewall on that box. You should be running one on ANY machine connected to the Internet. You can open a hole in the firewall for the web server, and still block everything else.
Now, as for what you are seeing, it is someone looking to see what windows file sharing shares your box has. They are looking for windows machines that have file/print sharing enabled, and no firewall. If this were a Windows machine, they could then access those files, and possible write new files to the system. It depends on how file sharing is set up. The same thing can also be done to a Linux box running Samba. (You can set other protections in Samba, that you can not in Windows file sharing, but that is besides the point...) Windows boxes that can be accessed this way are a tempting target because chances are they don't have the latest security updates, and because the owner of the box doesn't know security. A Linux box with these ports open is also a targer, because the ports should not be open on a properly secured box. Do us all a favof, and check out Shorewall, or another firewall setup program. Shorewall is included with 9.2, and is not that hard to set up... Mikkel
____________________________________________________ Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com Join the Club : http://www.mandrakeclub.com ____________________________________________________
