Re: [cobalt-users] IPs related to hackers

[Mike Vanecek <nospam99@xxxxxxxxxxxx>]

On Sun, 11 Feb 2001 12:22:07 +1000, "fastmedia" <inc@xxxxxxxxxxxxx> wrote:

:>
:>> > PortSentry adds IPs to the /etc/hosts.deny file so if I'm a bit late
:>> > watching the logcheck messages, the IPs are already blocked. PortSentry
:>> > doesn't add IPs that are being used to run FTP anonymous login scripts
:>or
:>> > IPs that are being used to attempt logins using the admin ID so I drop
:>> > those in by hand.
:>
:>this "hosts.deny" file doesn't seem to block nameserver or ftp requests.
:>my server was recently compromised via proftpd by the looks of it.
:>
:>i think ipchains is the better blocking option, i'm presently studying
:>up on this.

I have openssh 2.3.0 installed that supports sftp. I have disabled ftp
entirely. Any file transfer will have to be via sftp. If that is not possible,
you may wish to consider moving the ftp ports from 20/21 to something else in
the <1024 range. Of course, that means all of your customers have to change
their clients. Any hits on 20/21 now trigger my portsentry.