have you disabled ident on the imap processes? that can cause security alerts even though it is not considered an attack
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason Haar Sent: Thursday, April 29, 2004 5:40 PM To: [EMAIL PROTECTED] Subject: Re: [Qmail-scanner-general]Port Scan Attack On Thu, Apr 29, 2004 at 02:06:43PM -0700, Lloyd Albin wrote: > Hello, > > Since I upgraded our email server to qmail-scanner-1.21st (from 1.16) > and courier-imap-3.0.3 (from 2.2.1) we have been seeing Port Scan > Attack's hit client computers which are running McAfee Internet Security > Suite 6 and behind a Netgear Firewall. Sorry - you're a bit vague there. Are you saying you are seeing port scans originating from your Qmail-Scanner server? If so, then either the box is compromised, or your firewall/IDS is misidentifying attacks Not really much to do with Qmail-Scanner.... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
