Re: [cobalt-users] hosts.deny listing

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

From: "Wayne Sagar" <wsagar@xxxxxxxx>


> Question for those who have been monitoring their systems longer than I
> have.. is this a normal level of activity we're currently seeing or is
this
> growing very rapidly? It seems amazing that we can even keep a machine
> online with the current level....

Probably it has grown over the last few years, due to the growth of the
internet in general. This is just script kiddie behavior... kids who scan
ports 111 and 137-9 are looking for common vulnerabilities on unix and
windows systems (respectively). With a decent portscanner, its easy to scan
thousands of IP addresses in seconds to find vulnerable systems.

This is not something you should worry about. If you are concerned that your
hosts.deny file is too large, remove ports 111 and 137 from the portsentry
list. Your box doesn't run services on these ports anyway, and generally if
this is the only port the kiddies are hitting, they don't have the knowledge
to hack your box.

Kevin