[cobalt-users] Active System Attack Query

[johnm@xxxxxxxxxxxxxxxxxxxx]

Revd leonard payne <vicarage@xxxxxxxxxxxxxx> wrote :-

>I am currently getting 1 or 2 scans a day - always to TCP Port 111
>Does anyone know what they are trying and why this port ?

Extract from "Linux Security Toolkit" book.

Port 111 is the 'SUNRPC' or Sun remote procedure call, developed by Sun 
Microsystems to level the playing field when it came to mounting file 
systems across a network, is used by the system to register all other RPC 
programs.  An nfs client will contact an nfs server across a network on 
the port first.
....

The RPC services are more secure that services like ftp, but can be fooled 
through spoofing.  These services do not check, but accept the client's 
word for thier identity. 
.....

Access to RPC services should be very closely controlled.
<end of extract>

Most of my port scans seem to be either on 22, 111 or 515 (printer)

Cheers

John