[Gllug] Hacked ?

[Gordon Joly]

At 11:47 +0000 2001-11-29, Paul Brazier wrote:
>Can anyone recommend an IDS (Intruder Detection System?)
>Can you use iptables for a simple version of this port scan detection or
>do you need something more complex?


I use portsentry and tripwire.

Recently I thought I had been hacked. I noticed that /etc/hosts.deny 
had about 12 new IP addresses added! Turned out the portsentry will 
an a line for each IP address that has a go....

Gordo

-- 
Gordon Joly//////////
gordon.joly at pobox.com
http://pobox.com/~or/

-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug