RE: [cobalt-users] hack again - how to drop a connection

["Network Operations" <admin@xxxxxxxx>]

put his IP in the hosts.deny file

might also try /sbin/route x.x.x.x reject

x.x.x.x = his ip of course

John

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of
BSmith@xxxxxxxxxxx
Sent: Thursday, March 27, 2003 4:37 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: RE: [cobalt-users] hack again - how to drop a connection


-----Original Message-----
From: Andy Clyde, oxfordmusic.net
Subject: [cobalt-users] hack again - how to drop a connection


still fiddling about trying to back up data etc and i noticed that a
certain
IP is connected to my box on ports 4800 and 443. i want him off. nobody
but
me should be connecting to this box for anything other than DNS - i'm
pretty
sure this could be the hacker. how can i boot him off from inside the
shell?

cheers

andy
_____________________________________


Andy,

The easiest way would be to use IPCHAINS.  You can get it from:
www.cobaltfaqs.com.  Once install, via your shell, you can type in the
following:

ipchains -A input --source x.x.x.x --protocol TCP \
	--destination-port 443 -j DENY
ipchains -A input --source x.x.x.x --protocol TCP \
	--destination-port 4800 -j DENY

x.x.x.x would of course be his IP address.

That will stop him from ever connecting again.  You may want to put on
more
policies.  If you are only using it for DNS, there are a lot of ports to
be
blocking.

~Brian

_____________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users