Date: Fri, 14 Dec 2001 17:53:10 -0800 From: "Crist J . Clark" <cjc@FreeBSD.ORG> To: Carlos Andrade <carlos@rjstech.com> Cc: security@FreeBSD.ORG Subject: Re: okay now I am worried Message-ID: <20011214175310.D3473@blossom.cjclark.org> In-Reply-To: <000001c184f6$133d72e0$fa01a8c0@rjstech.com>; from carlos@rjstech.com on Fri, Dec 14, 2001 at 04:21:35PM -0700 References: <bulk.96770.20010128124336@hub.freebsd.org> <000001c184f6$133d72e0$fa01a8c0@rjstech.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 14, 2001 at 04:21:35PM -0700, Carlos Andrade wrote:
> The following has been in my log for a few days :
> -x86 FreeBSD 4.2 machine (btw)
> -logging in vain is turned on
> -the only thing I am running is natd (gateway for our company) and very few
> ports are specifically left open
> -I do not allow inside traffic to go in to the outside nic (and vice versa)
> to stop spoofing
> -I specifically blocked ports 135, 139, 3389, 6667, 6668 cause nmap said
> that they were responding or open for some reason.
>
> (date) /kernel: Connection attempt to UDP 127.0.0.1:512 from 127.0.0.1:XXXX
biff(1). Compare the date to times of mail delivery in
/var/log/maillog.
> where XXXX has been the following :
> 1389, 1396, 1523, 1530
Ephemeral ports. Expected.
[snip]
> running ps -auwx | sort | uniq returns
Hmmm. The uniq(1) is somewhat pointless since each line is guaranteed
unique due to the PID.
[snip]
> reading up on the ports udp 512 is biff, but I am not running any mail
> server. The only mail I get is generated by daily reports in cron.
Which delivers mail locally and will do the old biff(1) thang.
> so am I crazy or ?
Dunno if you are crazy, but there is nothing suspicious here.
--
"It's always funny until someone gets hurt. Then it's hilarious."
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011214175310.D3473>