Re: [cobalt-users] spam exploits

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Friday 11 April 2003 17:39, Dan Kriwitsky wrote:
> > I've got a static IP account for my webserver.
> >
> > My webserver has been exploited for porno spams over the last
> > 48 hours. My logs say it's being relayed from 66.159.211.40,
> > which belongs to DSLExtreme, provider of my static IP, and is
> > NOT my static IP, though close.
> >
> > I've done various things on my 550 webserver, like IP Address
> > Allocation to no longer accept the above.
> >
> > So, what needs to be done now to plug this up and can DSLE do
> > anything?
>
> What do you mean by "exploited"?

try this as root.
iptables -A INPUT -p tcp -s 66.159.211.40 -j DROP

Gerald
-- 
http://frontstreetnetworks.com | http://store.raqware.com
Front Street Networks LLC      |  Phone: 203-785-0699
229 Front Street, Ste #C, New Haven, CT 06513-3203