Re: Problem with logging firewall packets

2001-05-25 Thread Giacomo Mulas
On Fri, 25 May 2001, Paul Dossett wrote: Okay, I'm *really* embarrassed about this, but I can't get syslog to log firewall packets to a logfile - it insists on sending them to my Debian box's console. I've checked the /etc/syslog.conf file and there's no mention of a console there at all,

Re: wdm security

2001-05-25 Thread Juha Jäykkä
I would not trash wdm just yet. Let me take a look. If you're concerned, you might want to firewall that port using ipchains or iptables. No problem - I am currently behind an ipchains firewall, but it's about to change and I just wanted to know if something breaks if I ipchain/table the

RE: Problem with logging firewall packets

2001-05-25 Thread Ed Street
Hello, # # LOG level option. NOTE klogd reflects these values for console broadcast # Simply start klogd with -c 4 to ONLY display errors and above on the console. LOG_LEVEL=notice #define KERN_EMERG 0 /* system is unusable

Re: detecting portscanning

2001-05-25 Thread Vladislav
Hello, --- Rudy Gevaert [EMAIL PROTECTED] wrote: Check out www.snort.org. Snort capable to detect portscans. Note, that not only portscans, but [skip] Could I use this with ippl? Or just on portscanning system? As you wish, but you don`t needed any additional ip-logging systems, when you

Re: Problem with logging firewall packets

2001-05-25 Thread Chris Boyle
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 25 May 2001 8:42 am, Giacomo Mulas wrote: iptables, however. Logs from iptables are indeed recorded in the logs, but they also *always* turn up on whatever console I am using. The kernel log Check /etc/syslog.conf for anything directing

Re: strange log entry

2001-05-25 Thread Jacob Meuser
On Thu, May 24, 2001 at 05:30:14AM -0800, Ethan Benson wrote: On Thu, May 24, 2001 at 05:41:08AM -0700, Jacob Meuser wrote: On Thu, May 24, 2001 at 04:06:08AM -0800, Ethan Benson wrote: On Thu, May 24, 2001 at 04:50:57AM -0700, Jacob Meuser wrote: BS, when was the last time you

RE: wdm security

2001-05-25 Thread John Galt
On Fri, 25 May 2001, Steve wrote: Ed == Ed Street [EMAIL PROTECTED] writes: Hello, If memory serves me correctly there's a line in /etc/X11 that you can add/modify to tell it to NOT lissen. startx -- -nolisten tcp will have the effect. However, there doesn't seem to be a global setting

Re: wdm security

2001-05-25 Thread Chris Boyle
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 25 May 2001 10:00 am, John Galt wrote: On Fri, 25 May 2001, Steve wrote: Ed == Ed Street [EMAIL PROTECTED] writes: Hello, If memory serves me correctly there's a line in /etc/X11 that you can add/modify to tell it to NOT lissen.

Re: wdm security

2001-05-25 Thread Bernhard R. Link
On Thu, 24 May 2001, Noah L. Meyerhans wrote: Interestingly enough, a quick find/grep traversal of the wdm source indicates that the only code for setting up network listeners comes directly from the xdm sources without modification at all. That implies to me that the listener on port 32768

Re: strange log entry

2001-05-25 Thread Ethan Benson
On Fri, May 25, 2001 at 01:55:35AM -0700, Jacob Meuser wrote: Well, you /could/ just check their sources. They're on the web you know. http://www.openbsd.org/cgi-bin/cvsweb/ They're published in public, what more do you really want? It's pretty easy to find out when and who made

Re: proftpd exploit??

2001-05-25 Thread Matthias Richter
Marcelo Drudi Miranda wrote on Sat May 26, 2001 at 02:49:02AM: Matthias Richter [EMAIL PROTECTED] escreveu: Andres Herrera wrote on Thu May 24, 2001 at 07:43:50PM: [proftpd exploit ls ../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../] Any solution?? This is a exploit or a Dos

Re: detecting portscanning

2001-05-25 Thread Rudy Gevaert
Hello, On Thu, 24 May 2001, Vladislav wrote: Check out www.snort.org. Snort capable to detect portscans. Note, that not only portscans, but other strange activities (i.e. tracing, os fingerprinting, etc) and attacks. You can download sources from original site or get *.deb from debian (it

Re: Problem with logging firewall packets

2001-05-25 Thread Giacomo Mulas
On Fri, 25 May 2001, Paul Dossett wrote: Okay, I'm *really* embarrassed about this, but I can't get syslog to log firewall packets to a logfile - it insists on sending them to my Debian box's console. I've checked the /etc/syslog.conf file and there's no mention of a console there at all, so

Re: wdm security

2001-05-25 Thread Juha Jäykkä
I would not trash wdm just yet. Let me take a look. If you're concerned, you might want to firewall that port using ipchains or iptables. No problem - I am currently behind an ipchains firewall, but it's about to change and I just wanted to know if something breaks if I ipchain/table the

RE: Problem with logging firewall packets

2001-05-25 Thread Ed Street
Hello, # # LOG level option. NOTE klogd reflects these values for console broadcast # Simply start klogd with -c 4 to ONLY display errors and above on the console. LOG_LEVEL=notice #define KERN_EMERG 0 /* system is unusable

Re: detecting portscanning

2001-05-25 Thread Vladislav
Hello, --- Rudy Gevaert [EMAIL PROTECTED] wrote: Check out www.snort.org. Snort capable to detect portscans. Note, that not only portscans, but [skip] Could I use this with ippl? Or just on portscanning system? As you wish, but you don`t needed any additional ip-logging systems, when you

Re: Problem with logging firewall packets

2001-05-25 Thread Chris Boyle
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 25 May 2001 8:42 am, Giacomo Mulas wrote: iptables, however. Logs from iptables are indeed recorded in the logs, but they also *always* turn up on whatever console I am using. The kernel log Check /etc/syslog.conf for anything directing

RE: wdm security

2001-05-25 Thread Steve
Ed == Ed Street [EMAIL PROTECTED] writes: Hello, If memory serves me correctly there's a line in /etc/X11 that you can add/modify to tell it to NOT lissen. startx -- -nolisten tcp will have the effect. However, there doesn't seem to be a global setting that will enforce it system-wide,

Re: strange log entry

2001-05-25 Thread Jacob Meuser
On Thu, May 24, 2001 at 05:30:14AM -0800, Ethan Benson wrote: On Thu, May 24, 2001 at 05:41:08AM -0700, Jacob Meuser wrote: On Thu, May 24, 2001 at 04:06:08AM -0800, Ethan Benson wrote: On Thu, May 24, 2001 at 04:50:57AM -0700, Jacob Meuser wrote: BS, when was the last time you

RE: wdm security

2001-05-25 Thread John Galt
On Fri, 25 May 2001, Steve wrote: Ed == Ed Street [EMAIL PROTECTED] writes: Hello, If memory serves me correctly there's a line in /etc/X11 that you can add/modify to tell it to NOT lissen. startx -- -nolisten tcp will have the effect. However, there doesn't seem to be a global setting

Re: wdm security

2001-05-25 Thread Chris Boyle
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 25 May 2001 10:00 am, John Galt wrote: On Fri, 25 May 2001, Steve wrote: Ed == Ed Street [EMAIL PROTECTED] writes: Hello, If memory serves me correctly there's a line in /etc/X11 that you can add/modify to tell it to NOT lissen.

Re: wdm security

2001-05-25 Thread Bernhard R. Link
On Thu, 24 May 2001, Noah L. Meyerhans wrote: Interestingly enough, a quick find/grep traversal of the wdm source indicates that the only code for setting up network listeners comes directly from the xdm sources without modification at all. That implies to me that the listener on port 32768

Re: strange log entry

2001-05-25 Thread Ethan Benson
On Fri, May 25, 2001 at 01:55:35AM -0700, Jacob Meuser wrote: Well, you /could/ just check their sources. They're on the web you know. http://www.openbsd.org/cgi-bin/cvsweb/ They're published in public, what more do you really want? It's pretty easy to find out when and who made changes