I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs
Commands Run:
User root:
/sbin/service portsentry restart >/dev/null && /sbin/service iptables restart >/dev/null: 72 Time(s)
Then the portsentry log is:
--------------------- PortSentry Begin ------------------------
Ignored following ports
Advanced Stealth:
TCP: ports: 21-22 25 53 80 110-111 113 135 137-139 443 932
Excluded following ports
Advanced: ports: 21-22 25 53 80 110 113 135 137-139 443
**Unmached entries**
72 Time(s): adminalert: Advanced mode will monitor first 1024 ports
72 Time(s): adminalert: ERROR: Socket 111 is in use and will not be monitored. Attempting to continue
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 1
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 111
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 137
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 138
etc etc ...... then
144 Time(s): adminalert: PortSentry 1.2 is starting.
144 Time(s): adminalert: PortSentry is shutting down
144 Time(s): securityalert: PortSentry is shutting down
---------------------- PortSentry End -------------------------
I am a little puzzled to say the least, if i log on and start portsentry manually i get an okay for the close and an okay for the start, so i can get it to run, just cant seem to stop it from starting and stopping after that.
I have looked in crontab and there is no repeating entry for the first section [ commands run] this log is from cron.
If anyone else has come accross this, or can give me a clue then that would be great.
thanks
/etc/cron.hourlyand/etc/cron.daily? – Khaled Jan 23 at 10:32