From owner-freebsd-questions Fri Feb 16 6:26:31 2001 Delivered-To: freebsd-questions@freebsd.org Received: from ringworld.nanolink.com (ringworld.nanolink.com [195.24.48.189]) by hub.freebsd.org (Postfix) with SMTP id CA76437B684 for ; Fri, 16 Feb 2001 06:26:17 -0800 (PST) Received: (qmail 12802 invoked by uid 1000); 16 Feb 2001 14:24:07 -0000 Date: Fri, 16 Feb 2001 16:24:07 +0200 From: Peter Pentchev To: Artem Koutchine Cc: questions@FreeBSD.ORG, security@FreeBSD.ORG Subject: Re: rpc.statd attack Message-ID: <20010216162407.D474@ringworld.oblivion.bg> Mail-Followup-To: Artem Koutchine , questions@FreeBSD.ORG, security@FreeBSD.ORG References: <004201c09823$1a423dc0$0c00a8c0@ipform.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <004201c09823$1a423dc0$0c00a8c0@ipform.ru>; from matrix@ipform.ru on Fri, Feb 16, 2001 at 05:16:47PM +0300 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Fri, Feb 16, 2001 at 05:16:47PM +0300, Artem Koutchine wrote: > Hi! > > I am regulary getting this: > [snip (unsuccessful, useless against fbsd) attack log] > > What port should i close or log to detect the connection? I am sure > this is a script > kiddie, so no IP spoffing or anything tricky is envolved. I'd like log > it with ipfw and > kick that junkie butt. So, what port is it or as always with RPC it is > a tricky business? If you consider rpcinfo -p | egrep -e 'udp.*status$' | awk '{print $4}' to be a tricky business, then yes, it is a tricky business ;) G'luck, Peter -- When you are not looking at it, this sentence is in Spanish. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message