-----BEGIN PGP SIGNED MESSAGE----- On Fri, 24 Sep 1999, John Lapeyre wrote:
: Dear Security Staff: : I received 2086 connection attempts at several ports on September 22. : The attempts were made from IP address pavlov.midco.net [24.220.0.13] : The machine whose ports were scanned is 128.196.189.45 . : Please make sure that this port scanning does not happen again. : : Here are the first and last connection attempts : : Sep 22 02:01:23 homey tcplogd: auth connection attempt from pavlov.midco.net [24.220.0.13] : Sep 22 21:20:18 homey tcplogd: port 24011 connection attempt from pavlov.midco.net [24.220.0.13] : : Thanks for your cooperation. Mr. Lapeyre, You do realise that pavlov.midco.net is part of the DNS rotation http.us.debian.org? [EMAIL PROTECTED]:~ $ host pavlov.midco.net pavlov.midco.net A 24.220.0.13 ^^^^^^^^^^^ [EMAIL PROTECTED]:~ $ host http.us.debian.org http.us.debian.org A 206.187.92.15 http.us.debian.org A 207.69.194.216 http.us.debian.org A 209.249.97.234 http.us.debian.org A 141.213.4.21 http.us.debian.org A 24.220.0.13 ^^^^^^^^^^^ I see no evidence in the logs that you are being port scanned - I feel it's more likely that your use of the mirror here is at issue. You may of course disagree. Nevertheless, I will shut down the mirror here and rebuild this machine from scratch, implementing draconian and paranoid security measures. If I receive further complaints of "abuse" from Debian project participants, I will be forced to remove the mirror entirely. Complaints to "[EMAIL PROTECTED]" are viewed by members of the management team as well as members of the technical staff, and I regret to inform you that one of the members of the management team has reacted to your complaint in an abusive and non-productive manner that will certainly impact our ability to help Debian in the future. I regret the "shoot the messenger" tone of this email; understandably security is important and potential abuses should be dealt with swiftly and forcefully, given the state of the Internet today. Nevertheless, common sense can and should be exercised whenever possible. I reiterate that today I remove "pavlov.midco.net" from the mirror rotation "http.us.debian.org". HTTP, FTP, and RSYNC access to this machine will be turned off upon completion of this email. The machine will be shut down and rebuilt from scratch. Mirror services *may* be restored at that point, if I can convince management that the benefits of hosting a mirror outweigh the liabilities. Sincerely, - -- Nathan Norman - Network Specialist mailto:[EMAIL PROTECTED] High Speed Internet Access http://www.midco.net finger [EMAIL PROTECTED] for PGP Key ID: (0xA33B86E9) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBN+0ovAXl8N+jO4bpAQGTmQP9Eyff8etuyzQkYx3kKry2QJTlpP5KGTj4 hiIkViV2d3T6rOJ1paeESYjMrzycNLBBdqSNMvmnBYMzSC3fY9ykdNBSC/wUEBfq Q4oCG+OYOovDJDQXxurDj0/HgZzoIGPt8lx3ODDox34jris/hhu3qruE9RlHcT13 0sgwXKTBcp8= =fgR7 -----END PGP SIGNATURE-----