From owner-freebsd-questions Wed Aug 11 14:17:45 1999 Delivered-To: freebsd-questions@freebsd.org Received: from post.mail.nl.demon.net (post-10.mail.nl.demon.net [194.159.73.20]) by hub.freebsd.org (Postfix) with ESMTP id 792F714E38; Wed, 11 Aug 1999 14:17:32 -0700 (PDT) (envelope-from marc@oldserver.demon.nl) Received: from [212.238.105.241] (helo=interim) by post.mail.nl.demon.net with smtp (Exim 2.02 #1) id 11Efja-00014Y-00; Wed, 11 Aug 1999 21:16:30 +0000 Message-ID: <014501bee43e$ce854ba0$0300000a@oldserver.demon.nl> From: "Marc Schneiders" To: "Greg Black" , "Doug White" Cc: "Donald Burr" , "FreeBSD Questions" , "FreeBSD Security" References: <19990811171943.8382.qmail@alice.gba.oz.au> Subject: Re: umountall requests - what does this all mean? Date: Wed, 11 Aug 1999 23:16:40 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Greg Black writes: > Doug White writes: > > > > Aug 7 19:04:49 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > > > > > 207.71.226.193 is the IP addressed assigned to me by my ADSL provider, so > > > I can only assume that these packets are coming in through the ADSL modem. > > > > > > What do these messages mean, and should I be worried about them? And how > > > do I block them? > > > > What IP is 60-Hz? > > > > It's probably another machine trying to dismount partitions and mountd > > doesn't recognize it. Probably harmless. > > I got some similar messages on a 3.2 box a couple of days ago. > At the time it was connected only to my home LAN and no machines > outside of my office were physically connected to the LAN for > some hours before or after the messages appeared. I was doing > some NFS mounts to that box, but there was no genuine umount > request at the time the message appeared. In fact, now that I > check the log, the IP that the alleged request came from was the > IP of the host that complained -- there was no umount ever done > on the box that day. [...] I get the message in the following circumstances: I kill mountd on another NFS-server *through telnet*.(It happens to be running OpenBSD.) The FreeBSD box (4.0 snapshot 4 July), also configured as an NFS-server (because I use it for src/CVSUP for another FreeBSD, dual PPro, machine), gives the complaint mentioned in the subject, blaming itself for the request. Apparently it listens to this request telnetted to another NFS-host on some (unpriviliged) port and finds it worthwile to tell us. Is this a bug or a stupid user who misconfigured his LAN? Marc Schneiders marc@oldserver.demon.nl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message