Re: [cobalt-users] IPs related to hackers

[Diana Brake <diana@xxxxxxxxxxxxx>]

At 09:22 PM 2/10/01, Chris wrote:

> > > PortSentry adds IPs to the /etc/hosts.deny file so if I'm a bit late
> > > watching the logcheck messages, the IPs are already blocked. PortSentry
> > > doesn't add IPs that are being used to run FTP anonymous login scripts
> or
> > > IPs that are being used to attempt logins using the admin ID so I drop
> > > those in by hand.
>
> this "hosts.deny" file doesn't seem to block nameserver or ftp requests.
> my server was recently compromised via proftpd by the looks of it.
>
> i think ipchains is the better blocking option, i'm presently studying
> up on this.
>
> --
> chris paul
> fastmedia.net

Hi Chris,
I think you're correct, but for those of us on RaQ2s that can't use 
IPchains, this is a start. My next project is to figure out ipfwadm for 
this MIPS thingy..:)

see ya,
Diana
Crest Communications, Inc.		diana@xxxxxxxxxxxxx
Beautiful Sunny Florida		http://crestcommunications.com/
352-495-9359, 425-732-9785 fax