Re: [cobalt-users] Hacking attempts on certain port what is thisused for?

["Carrie Bartkowiak" <ravencarrie@xxxxxxxx>]

I get a slightly different message on port 111, see below.  ( a whois piped
out through sendmail I think?)
Been getting 3 or so of these each day (from different IPs).

Feb 21 21:35:54 www portsentry[1233]: attackalert: Connect from host:
willow.cc.uic.edu/128.248.155.163 to TCP port: 111
Feb 21 21:35:55 www portsentry[1233]: attackalert: External command run for
host: 128.248.155.163 using command: "/usr/local/bin/whois 128.248.155.163 |
mail -s "
Feb 21 21:35:55 www portsentry[1233]: attackalert: Host 128.248.155.163 has
been blocked via wrappers with string: "ALL: 128.248.155.163"
Feb 21 21:35:55 www portsentry[1233]: attackalert: Host 128.248.155.163 has
been blocked via dropped route using command: "/sbin/route add -host
128.248.155.163 reject"

Gotta love portsentry.
Now if I could just figure out how to *not* clear out the hosts.deny file
when I reboot, I'd be all set.  ;)

CarrieB