Re: Some servvices on my edge box slow to reply

From: clvrmnky (clvrmnky-uunet_at_coldmail.com.invalid)
Date: 09/21/04 

Date: Tue, 21 Sep 2004 17:09:24 -0400

On 21/09/2004 3:20 PM, Peter Matulis wrote:

> Monitor your network traffic for anything suspicious. Have your
> firewall filter on both interfaces with a deny by default stance and
> add logging to those block rules. There is the chance that during the
> night some malware was activated. Have you *ever* installed any
> binary cracks? Hopefully this is not the case but you can't overlook
> the possibility. Good luck.
>
I have a default deny ruleset for both incoming and outgoing packets.
I'm only logging the interesting ones coming in, however. Netstat does
not show any odd services running. I've never installed a binary
"crack", or even a binary patch. I'm pretty sure I've never run a
binary that I didn't build myself, or was built by openbsd.org.

I've been concerned lately will all the attempts to hack ssh via weak
UID/passwords, and I also noticed that someone is trying to hack a web
service by passing it a long URL. So I was a bit paranoid this morning,
but didn't find anything suspicious.

It looks like I screwed up my reverse lookups in some manner a long time
ago and recently something has changed so that my screw-up is a problem.

I hope. All I need is a new stick of DDR RAM, and I can start building
my new box with a fresh install of OpenBSD 3.5.

Quantcast