From owner-freebsd-questions Wed Aug 11 1:51:14 1999 Delivered-To: freebsd-questions@freebsd.org Received: from mpp.pro-ns.net (mpp.pro-ns.net [208.200.182.72]) by hub.freebsd.org (Postfix) with ESMTP id D3F25150BA; Wed, 11 Aug 1999 01:51:09 -0700 (PDT) (envelope-from mpp@mpp.pro-ns.net) Received: (from mpp@localhost) by mpp.pro-ns.net (8.9.3/8.9.3) id DAA07718; Wed, 11 Aug 1999 03:50:50 -0500 (CDT) (envelope-from mpp) From: Mike Pritchard Message-Id: <199908110850.DAA07718@mpp.pro-ns.net> Subject: Re: umountall requests - what does this all mean? In-Reply-To: from Doug White at "Aug 9, 1999 04:39:42 pm" To: dwhite@resnet.uoregon.edu (Doug White) Date: Wed, 11 Aug 1999 03:50:50 -0500 (CDT) Cc: dburr@Powered-By.AC (Donald Burr), freebsd-questions@FreeBSD.ORG (FreeBSD Questions), freebsd-security@FreeBSD.ORG (FreeBSD Security) X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > On Sat, 7 Aug 1999, Donald Burr wrote: > > > I keep getting log messages similar to these: > > > > Aug 7 19:04:49 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > Aug 7 19:04:53 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > Aug 7 19:47:59 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > Aug 7 19:48:03 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > > > 207.71.226.193 is the IP addressed assigned to me by my ADSL provider, so > > I can only assume that these packets are coming in through the ADSL modem. > > > > What do these messages mean, and should I be worried about them? And how > > do I block them? > > What IP is 60-Hz? 60.Hz should be that hostname of the machine that generated the syslog message. Misconfiguration? Maybe you need to recompile some binaries/build/install world? > It's probably another machine trying to dismount partitions and mountd > doesn't recognize it. Probably harmless. On my own home local network I can generate these types of messages my running mount/unmount as myself (e.g. non-root). E.g. mpp% mount mpp:/shared /shared Will generate a mountd messages on my NFS server that look like what you are seeing above. Since the address you gave is supposed to be your own machine, maybe you forgot to su to root before trying to mount something? Or maybe someone is try to spoof your IP address and unmount all of your file systems. -- Mike Pritchard mpp@FreeBSD.ORG or mpp@mpp.pro-ns.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message