On 4 Mar 2001, Dominic Mitchell wrote:
>
>
> Hi,
>
> I these kind of entries in /varr/log/messages:
>
> Mar 4 11:12:57 rlevesque portmap[7671]: connect from 211.169.224.32 to
>getport(status): request from unauthorized host
> Mar 4 11:54:48 rlevesque amd[540]: reload of map /etc/amd.net is not needed (in
>sync)
>
> How should I interpret these entries? Should I consider them as
> threatening?
>
> Thanks,
>
> Dominic.
>
Chances are someone is trying to crack your machine. Portmap is the
faverite attack point right now. You should consider blocking all
connection attempts to port 111 from outside your local network with
your firewall. Right now, they are being blocked by tcp wrappers.
Having your firewall block these attempts add another layer of safty, as
well as making port scans a bit harder.
Mikkel
--
Do not meddle in the affairs of dragons,
for you are crunchy and taste good with ketchup.
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
