I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs

Commands Run:
User root:
   /sbin/service portsentry restart >/dev/null && /sbin/service iptables restart >/dev/null: 72 Time(s)

Then the portsentry log is:

--------------------- PortSentry Begin ------------------------ 


 Ignored following ports
Advanced Stealth:
   TCP: ports: 21-22 25 53 80 110-111 113 135 137-139 443 932

Excluded following ports
Advanced: ports: 21-22 25 53 80 110 113 135 137-139 443

**Unmached entries**
72 Time(s): adminalert: Advanced mode will monitor first 1024 ports
72 Time(s): adminalert: ERROR: Socket 111 is in use and will not be monitored. Attempting to continue
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 1
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 111
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 137
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 138
etc etc ......   then
144 Time(s): adminalert: PortSentry 1.2 is starting.
144 Time(s): adminalert: PortSentry is shutting down
144 Time(s): securityalert: PortSentry is shutting down

 ---------------------- PortSentry End ------------------------- 

I am a little puzzled to say the least, if i log on and start portsentry manually i get an okay for the close and an okay for the start, so i can get it to run, just cant seem to stop it from starting and stopping after that.

I have looked in crontab and there is no repeating entry for the first section [ commands run] this log is from cron.

If anyone else has come accross this, or can give me a clue then that would be great.

thanks

link|improve this question
It is not clear from where you got these logs. Did you look into the folders /etc/cron.hourly and /etc/cron.daily? – Khaled Jan 23 at 10:32
I have found the entry in cron.d and it says: 03,23,43 * * * * root /sbin/service portsentry restart >/dev/null && /sbin/service iptables restart >/dev/null and restat portsentry to reset the history file, is this normal? – minus4 Jan 23 at 10:37
oh and the logs are from logwatch and is a collection of all logs from /var/log – minus4 Jan 23 at 10:37
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown

Browse other questions tagged or ask your own question.