Article View: uk.comp.os.linux
Article #441Re: Security
From: Nix
Date: Fri, 17 Dec 1999 00:00
Date: Fri, 17 Dec 1999 00:00
43 lines
2987 bytes
2987 bytes
Steve Dodd <dirk@loth.demon.co.uk> writes: > > tcp 0 0 *:nntp *:* LISTEN > > My NTP server??? > > NNTP -- you seem to running a news server. INN or Cnews probably, or maybe > leafnode (does anyone know if the latter has an NNTP interface?). You ought > to make sure that no unauthorised bods can post through it; you probably > don't want anyone reading from it either over a dial-up link, however public > spirited you are. I regularly see people probing my news server, presumably > look for an open one to spam Usenet through. There is a teergrubing news server around, which sits there pretending to be a news server and absorbing and throwing away everything posted to it. At least one ISP used it to get a bunch of notorious spammers whose contracts with the ISP stopped them from being dumped to throw their news into a black hole for months on end. > > tcp 0 0 *:omniorb *:* LISTEN > > omniorb is presumably an CORBA ORB. I think Gnome may use it. It is an ORB, but GNOME uses ORBit, not omniORB. > This is identd, and /fairly/ > harmless; people can connect to it and give it a a port number, and it returns > the user name of the person who owns the corresponding socket. It's only use > is AFAICT for remote sys admins to log; if they spot any abuse coming from > a multiuser system they can forward the info to the other system's admin > to aid LARTing. You could kill it if you want to, or use an identd which > returns random info, or similar. I believe some IRC networks insist on being > about to identd you before letting you on. Numerous FTP servers also require that. I've got a masquerading identd that runs on a masquerading host and forwards identd connections to the host they're coming from on the far side of that host. -- `So now the tape drive is sitting out in the yard, and I have to replace the tape drive and the window I threw it through.' --- Paul Tomblin on tape drives that crash and mangle your partition table
Technical Details
Message-ID:
<87zov9uvxg.fsf@loki.wkstn.nix>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<38513A2C.F927313@dunvegan1.demon.co.uk> <8302l8$hbd$1@falstaff.loth.demon.co.uk> <38539997.AE21B515@dunvegan1.demon.co.uk> <830kg5$j10$1@falstaff.loth.demon.co.uk>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d8ad,f54179a9240e5606
X-Google-Attributes: gid10d8ad,public
X-Google-Thread: fac57,f54179a9240e5606
X-Google-Attributes: gidfac57,public
From: Nix <$}xinix{$@esperi.demon.co.uk>
Subject: Re: Security
Date: 1999/12/17
Message-ID: <87zov9uvxg.fsf@loki.wkstn.nix>
X-Deja-AN: 562111328
X-NNTP-Posting-Host: esperi.demon.co.uk:194.222.138.8
References: <38513A2C.F927313@dunvegan1.demon.co.uk> <8302l8$hbd$1@falstaff.loth.demon.co.uk> <38539997.AE21B515@dunvegan1.demon.co.uk> <830kg5$j10$1@falstaff.loth.demon.co.uk>
X-Emacs: freely redistributable; void where prohibited by law.
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 945469592 nnrp-14:14905 NO-IDENT esperi.demon.co.uk:194.222.138.8
Organization: the Core
Newsgroups: uk.comp.os.linux,demon.tech.unix