[cobalt-users] Portsentry blocking port 22

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Monday 24 June 2002 11:16 am, Simon Pierce wrote:
> Portsentry has suddenly decided to block port 22 on one of our RaQ3s - ever
> since installing the RaQ3-All-Security-4.0.1-13453.pkg Cobalt patch last
> week.

> Any idea why this is and what I can do about it? Originally Portsentry was
> installed from a .pkg at http://www.linuxnetworking.co.uk/

> At present I can only Telnet in - so I'm desperate to get this sorted!

> (Additionally, it's amazing the huge amount of people (presumably hackers?)
> that have tried to access port 22 and been blocked by Portsentry since this
> happened)

thats normal, I get a lot of these also, only I get them as I put ip/domains 
in /etc/hosts.deny, if they hit 22

edit /usr/local/psionic/portsentry/portsentry.conf
look for something like this (The one you are using)
# Use these if you just want to be aware:
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,32770,32771,32772,32773,32774,31337,54321"
remove port 22 if it is in there

If you are using sshd @ port 22 it should not be in the list

then run
 /etc/rc.d/init.d/inet restart
 /etc/rc.d/init.d/sshd restart

-- 
Gerald Waugh 
http://frontstreetnetworks.com  SOHO Networks & Web Site Hosting
Front Street Networks LLC     voice +1 203 785 0699 * fax +1 203 785 1787
229 Front Street, Ste. #C, New Haven CT 06513-3203