Re: Break-in attempt from 203.197.38.247

[Fernando Cardoso <fernando () BN PT>]

> > This morning we discovered a possible break-in attempt. The
> alert came
> > from continous retries on the pop3 and telnet ports. POP3 was
> > accidentely was left open although no pop3 service nor mail
> service is
> > installed.
> >
> > > From /var/log/secure:
> > --------------------
> > Aug 22 01:09:34 jupiter ipop3d[3954]: connect from 203.197.38.247
> > Aug 22 01:09:34 jupiter ipop3d[3954]: error: cannot execute
> > /usr/sbin/ipop3d: No such file or directory
> Check your logs, the original attack must have occured before this...
> The intruder damaged your system and deleted files before,
> including ipop3d.

Maybe not. What happen here was probably this: inetd.conf had an uncommented
pop3d line pointing to /usr/sbin/ipop3d. Because of that, inetd was
listening on port 110, but ipop3d was not installed. As far as I remember,
some distributions like RedHat don't install pop3 in a default installation.
So, this was probably a pre-attack TCP connect() port scan made by
203.197.38.247.

Fernando

_________________________________________________________________
Fernando Cardoso                        Phone:  +351 21 7982186
Network Administrator           Fax:            +351 21 7982185
National Library                        E-mail: fernando () bn pt
Portugal                                PGP ID: 28551CB8