🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: uk.comp.os.linux
Article #441

Re: Security

#441
From: Nix
Date: Fri, 17 Dec 1999 00:00
43 lines
2987 bytes
Steve Dodd <dirk@loth.demon.co.uk> writes:

> > tcp        0      0 *:nntp                  *:*                     LISTEN
> > My NTP server???
> 
> NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
> leafnode (does anyone know if the latter has an NNTP interface?). You ought
> to make sure that no unauthorised bods can post through it; you probably
> don't want anyone reading from it either over a dial-up link, however public
> spirited you are. I regularly see people probing my news server, presumably
> look for an open one to spam Usenet through.

There is a teergrubing news server around, which sits there pretending
to be a news server and absorbing and throwing away everything posted to
it. At least one ISP used it to get a bunch of notorious spammers whose
contracts with the ISP stopped them from being dumped to throw their
news into a black hole for months on end.

> > tcp        0      0 *:omniorb               *:*                     LISTEN
> 
> omniorb is presumably an CORBA ORB. I think Gnome may use it.

It is an ORB, but GNOME uses ORBit, not omniORB.

>                                             This is identd, and /fairly/
> harmless; people can connect to it and give it a a port number, and it returns
> the user name of the person who owns the corresponding socket. It's only use
> is AFAICT for remote sys admins to log; if they spot any abuse coming from
> a multiuser system they can forward the info to the other system's admin
> to aid LARTing. You could kill it if you want to, or use an identd which
> returns random info, or similar. I believe some IRC networks insist on being
> about to identd you before letting you on.

Numerous FTP servers also require that.

I've got a masquerading identd that runs on a masquerading host and
forwards identd connections to the host they're coming from on the far
side of that host.

-- 
`So now the tape drive is sitting out in the yard, and I have to replace the
 tape drive and the window I threw it through.' --- Paul Tomblin on tape
drives that crash and mangle your partition table
Technical Details
Message-ID: <87zov9uvxg.fsf@loki.wkstn.nix>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <38513A2C.F927313@dunvegan1.demon.co.uk> <8302l8$hbd$1@falstaff.loth.demon.co.uk> <38539997.AE21B515@dunvegan1.demon.co.uk> <830kg5$j10$1@falstaff.loth.demon.co.uk>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d8ad,f54179a9240e5606
X-Google-Attributes: gid10d8ad,public
X-Google-Thread: fac57,f54179a9240e5606
X-Google-Attributes: gidfac57,public
From: Nix <$}xinix{$@esperi.demon.co.uk>
Subject: Re: Security
Date: 1999/12/17
Message-ID: <87zov9uvxg.fsf@loki.wkstn.nix>
X-Deja-AN: 562111328
X-NNTP-Posting-Host: esperi.demon.co.uk:194.222.138.8
References: <38513A2C.F927313@dunvegan1.demon.co.uk> <8302l8$hbd$1@falstaff.loth.demon.co.uk> <38539997.AE21B515@dunvegan1.demon.co.uk> <830kg5$j10$1@falstaff.loth.demon.co.uk>
X-Emacs: freely redistributable; void where prohibited by law.
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 945469592 nnrp-14:14905 NO-IDENT esperi.demon.co.uk:194.222.138.8
Organization: the Core
Newsgroups: uk.comp.os.linux,demon.tech.unix