Antivirus for FC3 4929

Neil T. Dantam Well, I often get port scans done on my machine. And so many pings I just stopped logging them (though I reject most of them). So while I buttume my machine, which is on a 2-machine LAN, is of no great interest intrinsically to crackers, they might like to use it as an open relay (I get lots of attempts, mainly for Taiwan, to do that), or as a participant in a distributed denial of service project. The even try to rummage around in my nameserver, but since all attempts at port 53 from the Internet are blocked by my firewall, they do not get far.

But the port scans sometimes try all ports, both TCP and UDP, from 0 to 1023, although some are more selective. They all fail (AFAIK), but they clutter up the message log and it offends me that they keep trying.

The attacks at my nameserver offend me a lot because I usually get a huge batch from lots of different IP addresses (some seriously different) at once. Then they take a rest for 20 minutes or so, and then try again from roughly the same bunch of IP addresses. I buttume this is some kind of denial of service attack, but I have several laughs on them:

1.) my machine is on dial-up, so it takes quite a while to do anything to my machine. 2.) port 53 is blocked from the Internet, so they have to wait around to time out, which lowers their efficiency. 3.) named (bind) is configured to accept commands only from the machines on my LAN, so even if the firewall failed, they still could not get at it. 4.) even if they got through all of that, all they could find out is the IP address of my other machine, which is 168.something, which they would probably guess anyway. And if there is a bug in that code, all they could do, since it is chrooted away and owned by named, not root, they could not get much if they ever got that far. And all the files accessable by named are owned by root and read-only by named, they could not even change any of that.

Yet that is my most attacked port other than the mail transfer agent that has safeguards of its own. And I cannot very well change that one's port number or other systems could not send me e-mails.

-- .~. Jean-David Beyer Registered Linux User 85642. V PGP-Key: 9A2FC99A Registered Machine 241939. ^^-^^ 21:30:00 up 2 days, 14:31, 3 users, load average: 4.06, 4.18, 4.10