unknown incoming connection: problem?
Hi, recently, I got incoming connections to several port: X and ftp. Here's the log from XFree86.0.log: AUDIT: Thu Oct 17 07:21:22 2002: 1767 X: client 6 rejected from IP xxx.xxx.xxx.xxx port 3492 And the log from vsftpd: Tue Oct 15 17:49:47 2002 [pid 32566] [ftp] OK LOGIN: Client "xxx.xxx.xxx.xxx", anon password "-saint@" Tue Oct 15 17:49:47 2002 [pid 32569] [ftp] OK LOGIN: Client "xxx.xxx.xxx.xxx", anon password "-saint@" Tue Oct 15 17:49:47 2002 [pid 32572] [ftp] OK LOGIN: Client "xxx.xxx.xxx.xxx", anon password "-saint@" Tue Oct 15 17:50:47 2002 [pid 32587] [ftp] OK LOGIN: Client "xxx.xxx.xxx.xxx", anon password "user@" Is this problem? Because afaik "saint" is somekind of portscanner? And note that although the day are different, connections to X and ftp came from the same IP address. I don't use firewall, and so far, in /var/log/messages, haven't encountered suspicious msgs. -- Verdi March --
Is this problem? Because afaik "saint" is somekind of portscanner? And note that although the day are different, connections to X and ftp came from the same IP address.
I don't use firewall, and so far, in /var/log/messages, haven't encountered suspicious msgs.
My advise, get a firewall, system running X and other various services has no business on the net. Our firewall which is unpublished ges scanned between 15 and 100 times a day. Many by robots, or worms but some are deliberate port scans searching exploitable ports.
participants (2)
-
Rowan Reid
-
Verdi March