Re: [cobalt-users] IPs related to hackers

["Colin J. Raven" <cjraven@xxxxxxxxxxx>]

On Sat, 10 Feb 2001, Diana Brake wrote:

> At 02:03 PM 2/10/01, you wrote:
> > > > My logs show several direct attempts from these numbers over the last few
> > > > days:
> ><snip>
> >Which log(s) are you referring to? /var/log/secure? messages?
> >
> 
> I have logcheck installed and it mails me suspicious activity as recorded 
> in the /var/log/messages. It can be configured to check on /var/log/secure 
> and /var/log/maillog
> 
> PortSentry adds IPs to the /etc/hosts.deny file so if I'm a bit late 
> watching the logcheck messages, the IPs are already blocked. PortSentry 
> doesn't add IPs that are being used to run FTP anonymous login scripts or 
> IPs that are being used to attempt logins using the admin ID so I drop 
> those in by hand.
Great info!!!
Thanks Diana, greatly appreciated and most useful to know!!!!!
-Colin