[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security: Compromised?



on Wed, Mar 21, 2001 at 01:05:42PM -0600, Dave Sherohman (esper@sherohman.org) wrote:
> On Wed, Mar 21, 2001 at 07:39:18PM +0100, William Leese wrote:
> > to me, this doesn't look good. half of these services i know i do not have 
> > installed, neither do they show up on a ps aux. I'm running tcpwrappers and 
> > portsentry, could this have something to do with it?
> 
> Yes.  portsentry listens on many ports (including all unused but
> 'interesting' ones) and reports on attempts to connect to them.  If you're
> running portsentry and want to see what ports are meaningfully open on the
> box, you have to temporarily shut down portsentry while the scan is
> performed.

snort is recommended over portsentry for this particular reason.  I'm
running portsentry but will likely switch.

-- 
Karsten M. Self <kmself@ix.netcom.com>    http://kmself.home.netcom.com/
 What part of "Gestalt" don't you understand?       There is no K5 cabal
  http://gestalt-system.sourceforge.net/         http://www.kuro5hin.org

Attachment: pgpbOlqpk6IGR.pgp
Description: PGP signature


Reply to: