Just a few questions. blackbox is the server name, and 192.168.0.2 is a remote computer on my network. I have thousands of these in my /var/log/messages file. What's going on? Every 2 or 3 seconds this entry appears. Aug 6 09:51:18 blackbox popper[2803]: connect from 192.168.0.2 Aug 6 09:51:19 blackbox popper[2804]: connect from 192.168.0.2 Aug 6 09:56:21 blackbox popper[2805]: connect from 192.168.0.2 Aug 6 09:56:22 blackbox popper[2806]: connect from 192.168.0.2 Aug 6 10:01:24 blackbox popper[2831]: connect from 192.168.0.2 Aug 6 10:01:25 blackbox popper[2832]: connect from 192.168.0.2 Aug 6 10:06:27 blackbox popper[2834]: connect from 192.168.0.2 Aug 6 10:06:28 blackbox popper[2835]: connect from 192.168.0.2 Aug 6 10:11:30 blackbox popper[2836]: connect from 192.168.0.2 Aug 6 10:11:31 blackbox popper[2837]: connect from 192.168.0.2 Also was this a successful logon? (below) or an attempt. Aug 5 20:24:21 blackbox login[1195]: ILLEGAL ROOT LOGIN on `ttyp0' from `192.168.0.2' I was looking through the log files because when i ran YAST, no settings were retrieved. Hostname showed as blank, no ethernet cards or IP addresses, everything. (naturally this concerned me) Now I'm afriad to reboot! My rc.config looks perfectly normal though. Where else should I look for some possible foulplay? [5 minutes later] I just rechecked rc.config. (it was fine ten minutes ago) now it's pretty much gone. this is all that is left: LANGUAGE="english" START_INETD="yes" START_PORTMAP="yes" NFS_SERVER="yes" yes that's it. definately not a good time to reboot! as far as I can tell, I'm [root] the only user logged on.
Stephen Smith wrote:
Someone on 192.168.0.2 is checking for mail! Let's have a lock, what "man popper" says: popper(8) popper(8) NAME popper - pop 3 server ... The entry appears not every 2 or 3 seconds but every 5 minutes (and 3 seconds --- that's a little bit strange). So it looks like an email client automaticly checking for new mail every 5 minutes. (I can't imagine that a cracker would start it's attempts every 5 minutes) But there may be probems with POP 3 servers already reported on this list.
Stephen Smith wrote:
Someone on 192.168.0.2 is checking for mail! Let's have a lock, what "man popper" says: popper(8) popper(8) NAME popper - pop 3 server ... The entry appears not every 2 or 3 seconds but every 5 minutes (and 3 seconds --- that's a little bit strange). So it looks like an email client automaticly checking for new mail every 5 minutes. (I can't imagine that a cracker would start it's attempts every 5 minutes) But there may be probems with POP 3 servers already reported on this list.
participants (2)
-
Kersten Bühnert -
Stephen Smith