Re: Security report question
On 9/30/07, Ian Smith [EMAIL PROTECTED] wrote: On Sun, 30 Sep 2007 09:41:00 -0700 Kurt Buff [EMAIL PROTECTED] wrote: On 9/30/07, Chuck Swiger [EMAIL PROTECTED] wrote: Kurt Buff wrote: [ ... ] +Limiting closed port RST response from 283 to 200 packets/sec I don't know what this means, though I suspect it could mean that I'm being port scanned. Is this a reasonable guess? Yes. It could also be something beating really hard on a single closed port, too. -- -Chuck Thanks. This, coupled with some invalid SSH login attempts from a known user, has made me quite suspicious. I think, though, that this is all that I can call it at this point - suspcious. Anything further I could turn up to monitor/log what's going on? It may help in spotting unwanted stuff getting past your firewall, to either add to /etc/rc.conf: log_in_vain=1 or (coming to the same thing) add to /etc/sysctl.conf: net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1 You can set the latter two sysctls immediately, of course. Cheers, Ian Looks like it's time to learn how to set up PF. This machine is internal to our enterprise, but in its own subnet separate from the server and the end-user subnets, between our firewall and our main router. The only ports open on it are SSH and SMTP, so I hadn't had the inclination, amongst all my other tasks, to set up that up. Handbook, here I come. Thanks for the help. Kurt ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: Security report question
Kurt Buff wrote: [ ... ] +Limiting closed port RST response from 283 to 200 packets/sec I don't know what this means, though I suspect it could mean that I'm being port scanned. Is this a reasonable guess? Yes. It could also be something beating really hard on a single closed port, too. -- -Chuck ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: Security report question
On 9/30/07, Chuck Swiger [EMAIL PROTECTED] wrote: Kurt Buff wrote: [ ... ] +Limiting closed port RST response from 283 to 200 packets/sec I don't know what this means, though I suspect it could mean that I'm being port scanned. Is this a reasonable guess? Yes. It could also be something beating really hard on a single closed port, too. -- -Chuck Thanks. This, coupled with some invalid SSH login attempts from a known user, has made me quite suspicious. I think, though, that this is all that I can call it at this point - suspcious. Anything further I could turn up to monitor/log what's going on? ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: Security report question
On Sun, 30 Sep 2007 09:41:00 -0700 Kurt Buff [EMAIL PROTECTED] wrote: On 9/30/07, Chuck Swiger [EMAIL PROTECTED] wrote: Kurt Buff wrote: [ ... ] +Limiting closed port RST response from 283 to 200 packets/sec I don't know what this means, though I suspect it could mean that I'm being port scanned. Is this a reasonable guess? Yes. It could also be something beating really hard on a single closed port, too. -- -Chuck Thanks. This, coupled with some invalid SSH login attempts from a known user, has made me quite suspicious. I think, though, that this is all that I can call it at this point - suspcious. Anything further I could turn up to monitor/log what's going on? It may help in spotting unwanted stuff getting past your firewall, to either add to /etc/rc.conf: log_in_vain=1 or (coming to the same thing) add to /etc/sysctl.conf: net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1 You can set the latter two sysctls immediately, of course. Cheers, Ian ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
RE: Security Report
-Original Message- From: Rus Foster [mailto:[EMAIL PROTECTED]] Sent: Monday, January 13, 2003 13:17 To: [EMAIL PROTECTED] Subject: Security Report Hi, Is it my imagination or should FreeBSD automatically make run a cron job to generate a security report? If so does anyone have the cron line? daily_status_security_enable=YES is the default, from /etc/defaults/periodic.conf. If you didn't change that in /etc/periodic.conf it should run as a part of the periodic daily. The periodic daily line in /etc/crontab is (by default): 1 3 * * * rootperiodic daily To Unsubscribe: send mail to [EMAIL PROTECTED] with unsubscribe freebsd-questions in the body of the message
Re: Security Report
On Mon, Jan 13, 2003 at 11:16:50AM +, Rus Foster wrote: Is it my imagination or should FreeBSD automatically make run a cron job to generate a security report? If so does anyone have the cron line? No, you're not imagining things. See /etc/crontab for the invocation of the periodic(8) script. The security report is generated as part of the daily periodic job. If you aren't receiving the reports, check that a) they aren't piling up in some mail queue somewhere: # mailq -v # mailq -Ac -v or b) that the default settings in /etc/periodic.conf haven't been set to redirect the report output somewhere else. Look for the 'daily_status_security_enable', 'daily_status_security_inline' and 'daily_status_security_output' settings. If you haven't got a /etc/periodic.conf file that's OK, as you'll just end up using the default settings from /etc/defaults/periodic.conf Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK To Unsubscribe: send mail to [EMAIL PROTECTED] with unsubscribe freebsd-questions in the body of the message
Re: Security Report
On Mon, 13 Jan 2003, Matthew Seaman wrote: On Mon, Jan 13, 2003 at 11:16:50AM +, Rus Foster wrote: Is it my imagination or should FreeBSD automatically make run a cron job to generate a security report? If so does anyone have the cron line? No, you're not imagining things. See /etc/crontab for the invocation of the periodic(8) script. The security report is generated as part of the daily periodic job. Thanks. Don;t suppose there is a tool to harden FreeBSD as well is there? I couldn't see anything in ports Rus To Unsubscribe: send mail to [EMAIL PROTECTED] with unsubscribe freebsd-questions in the body of the message
