Also, she doesn't send mail locally, but does from the ISP's shell. *shrug*
The host being scanned was a shell server operated by your ISP, right? Maybe one of their other customers triggered the scan.
"ForwardX11" was set locally on her laptop, and I saw "X11Forwarding yes" in the ISP's "/etc/sshd_config", so maybe that's how it happened.
The other setting of interest is "X11UseLocalhost" in the remote server's sshd config file. This controls whether your remote X11 listener is accessible over the network or just by clients on the same host as the sshd process.
-- Ken Herron _______________________________________________ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
