Actually, they may wise up and start running those scans from a
nameserver. (It's what I would do.) Then you would have to allow DNS
through while blocking all other ports from that IP, instead of blanket
denying the IP.
"Shawn T. Rutledge" wrote:
>
> On Thu, Mar 09, 2000 at 07:03:30PM -0800, Todd Jamison wrote:
> > I installed psionic portsentry tonight and i noticed
> > that authorized-scan.security.home.net/24.0.94.130
> > tried to connect to tcp 119 on my pc. Is this a
> > random scan or is it something I should be worried
> > about??? What happens if they find out that I am
> > running Linux???
>
> They won't care about that but if you're running any kind of "server" software
> (apache, sendmail, ftpd, telnetd etc) I recommend
>
> ipfwadm -I -a deny -S 24.0.0.0/8
>
> - a good security precaution as well as preventing them from finding out
> what ports you have open. And you will also have to make exceptions for
> the DNS servers, web server, news server and any other @home machines you
> need to access. For example,
>
> ipfwadm -I -a accept -S 24.1.240.33/32
> ipfwadm -I -a accept -S 24.1.240.34/32
> ipfwadm -I -a accept -S 24.1.240.71/32
>
> Put those rules in before the "deny" rule because the first matching rule
> will set the policy. And of course the syntax is different for ipchains
> (for kernels in the 2.2 series).
>
> Lessee... port 119 is nntp so evidently they were looking for rogue news
> servers.
>
> --
> _______ http://www.bigfoot.com/~ecloud
> (_ | |_) ecloud@bigfoot.com finger rutledge@cx47646-a.phnx1.az.home.com
> __) | | \__________________________________________________________________
> Get money for spare CPU cycles at http://www.ProcessTree.com/?sponsor=5903
>
> _______________________________________________
> Plug-discuss mailing list - Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
--
Digital Wokan
Tribal mage of the electronics age
Guerilla Linux Warrior
(text/plain)