It seem that some one or somebody from China keep scanning my servers ports, I guess he or she are try to get into my servers. Luckly I installed portsentry and firewall.
Does anybody got this kind of problem on a Cobalt servers envirnment?
Well I was thinking of blocking IP from China, but I don't think is a very good idea, unless is a CC fraud situation. I just leave it as it is. I just need to pay more attaintion on my servers, check all the logs files.
By the way have you read up the thread about CC fraud at WHT forum?? They block the entire Malaysia ISP's IP to prevent fraud!!
#
# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow. In particular
# you should know that NFS uses portmap!
ALL: ALL
It's counterpart hosts.allow has got a few ip's in it that are allowed access. Other then those, no one is allowed in, even if they have the right passwords.
That's the benefit of having multiple fixed ip-addresses. I've got two at home, and some on other computers I have access too.
With something like that, it seemed a very good idea to limit access to the server based on ip-addresses.
It's hard enough as it is, keeping up with all kinds of patches and fixes and whatever. It's easy to miss something, so I guess every little bit helps
Luckly I installed portsentry and firewall. 
New Post
Old Post
