[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
portsentry & chkrootkit (Was: Re: [cobalt-users] Chkrootkit query)
- Subject: portsentry & chkrootkit (Was: Re: [cobalt-users] Chkrootkit query)
- From: "Nico Meijer" <cobalt-users@xxxxxxxxxxxxxxx>
- Date: Wed Apr 4 02:22:05 2001
- List-id: Mailing list for users to share thoughts on Cobalt products. <cobalt-users.list.cobalt.com>
Hi Revd,
Do you have portsentry installed?
> Anyway I got one bad entry
> Checking `bindshell'... INFECTED (PORTS: 31337)
>
> I had already installed the BIND update from Cobalt
>
> What should I now do ?
Disable portsentry on this port. I had the same thing on a testmachine I
installed portsentry on.
I suggest you head on over to portsentry.conf, backup the lines you are
about to edit and delete all references to 31337 from those lines.
After that, or even better before that, add a rule to your ipchains firewall
and deny (and log) all traffic to port 31337.
Have a safe one... Nico