Hi,

I had just disconnected from a dial-up session with my ISP, and decided
to
check my /var/log entries before sutting down the machine. I found this in
/var/log/messages:

Apr  7 17:26:10 linuxbox kernel: registered device ppp0
Apr  7 17:26:10 linuxbox pppd[873]: pppd 2.3.11 started by root, uid 0
Apr  7 17:26:10 linuxbox pppd[873]: Using interface ppp0
Apr  7 17:26:10 linuxbox pppd[873]: Connect: ppp0 <--> /dev/ttyS3
Apr  7 17:26:11 linuxbox kernel: PPP BSD Compression module registered
Apr  7 17:26:11 linuxbox kernel: PPP Deflate Compression module registered
Apr  7 17:26:12 linuxbox pppd[873]: local  IP address 65.42.4.74
Apr  7 17:26:12 linuxbox pppd[873]: remote IP address 65.42.4.2
Apr  7 17:30:00 linuxbox CROND[954]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 17:40:00 linuxbox CROND[975]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 17:43:25 linuxbox pppd[873]: Terminating on signal 15.
Apr  7 17:43:25 linuxbox pppd[873]: Connection terminated.
Apr  7 17:43:25 linuxbox pppd[873]: Connect time 17.3 minutes.
Apr  7 17:43:25 linuxbox pppd[873]: Sent 59516 bytes, received 456293 bytes.
Apr  7 17:43:27 linuxbox pppd[873]: Exit.
Apr  7 17:50:00 linuxbox CROND[996]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:00:00 linuxbox CROND[1039]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:00:00 linuxbox kernel: PPP: ppp line discipline successfully
unregistered
Apr  7 18:01:01 linuxbox CROND[1044]: (root) CMD (run-parts
/etc/cron.hourly)
 
Apr  7 18:01:47 linuxbox xinetd[1046]: libwrap refused connection to telnet
from 127.0.0.1

Apr  7 18:10:00 linuxbox CROND[1076]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:20:00 linuxbox CROND[4563]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:30:00 linuxbox CROND[16712]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:40:00 linuxbox CROND[29458]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 18:50:00 linuxbox CROND[9315]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 19:00:00 linuxbox CROND[11820]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 19:01:00 linuxbox CROND[11822]: (root) CMD (run-parts
/etc/cron.hourly) 
Apr  7 19:10:00 linuxbox CROND[11843]: (root) CMD (   /sbin/rmmod -as) 
Apr  7 19:12:21 linuxbox kernel: hdd: ATAPI 40X CD-ROM drive, 128kB Cache
Apr  7 19:12:21 linuxbox kernel: Uniform CD-ROM driver Revision: 3.10
Apr  7 19:18:13 linuxbox kernel: CSLIP: code copyright 1989 Regents of the
University of California
Apr  7 19:18:14 linuxbox kernel: PPP: version 2.3.7 (demand dialling)
Apr  7 19:18:14 linuxbox kernel: PPP line discipline registered.

   What does the 18:01:47 entry mean?
   I did Not initiate the telnet.
   This machine is one of three on a private LAN, with IP addresses in the 192.168.x.x 
range. 
   At the time, the network was off-line (hub powered off.)
   I have no entry for 127.0.0.1 in /etc/hosts.allow. Should I have? Does xinetd, or 
some other
process need to be able to telnet to the loopback? Could something in CRON have 
initiated a
request to tcp/23 that was interpreted as a telnet request?

Insights would be helpful...............thanks,

                                                                                       
                 Tom



_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list

Reply via email to