Security

Ask something
Discussion Locked

Is this hacking issue?

0 helpful
5 replies

by lintadsl

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
I just checked the /var/log/message from my web server and found this.

May 17 22:40:24 meridian portmap[3896]: connect from 196.25.123.201 to getport(status): request from unauthorized host

May 17 14:54:37 meridian portmap[3705]: connect from 211.220.194.35 to getport(status): request from unauthorized host

May 17 14:54:39 meridian portmap[3706]:
connect from 211.220.194.35 to getport(status): request from unauthorized host

Is this someone trying to hack my box?
I have RH6.1 with IPchains installed.

It would be nice if we have Security topic that I can post.

Sunny,

5 replies

by stillatit

If the two IP addresses shown, 196.25.123.201 211.220.194.35 are not your own people, or somebody your own people were trying to connect to, then someone outside did probe your computer.

Good luck.

by bhaney

I wouldn't worry about this too much. Normally, you would see more of these log entries if someone was scanning ports on your machine. However, you might want to verify that you have all the security/firewalling that you require.

It's very normal to get port scanned on any broadband/always on connection. This happens to home users, corporate users . . . everyone. It's inevitable. Most of it is harmless script kiddie stuff that can be easily thwarted by only having certain necessary services running and requiring/validating legitimate use by authentication or some other means.

This discussion is closed to new replies.