WANTED: Cron Interpreter

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Ok, I understand about hda

>vesafb: probe of vesafb0 failed <<-- is this hd also?

What about the other entries? (httpd, pop, pam_unix, ...)

My todo list:

1. su root, shutdown -rF

ASKER

UPDATE

extract of fstab

/dev/hda /media/cdrecorder

--> /dev/hda is my dvd drive .... no need to check filesystem then

My todo list

<empty>

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Wes, the /dev/hda is my dvd drive... (just found out)

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

I see in the log, that there are connection attempts with xx.LOGEDIP.01, 02,03,04 and they are not users I authorized, and this on all kinds of service ports. Is it necessary for a web server with httpd, mysql, pop, smtp to have these ports open, and if not, how do I close ALL ports, except http, https, pop, pops, smtp, and mysql ?

This still leaves

vesaprobe thing

Failed to bind:
0.0.0.0 port 22 (Address already in use) : 4 Time(s)

--------------------- Cron Begin ------------------------

**Unmatched Entries**
STARTUP (V5.0)
STARTUP (V5.0)
STARTUP (V5.0)
STARTUP (V5.0)
STARTUP (V5.0)
STARTUP (V5.0)

---------------------- Cron End -------------------------

And

onnection attempts using mod_proxy:
81.LOGGEDIP.01 -> 1.3.3.7:1337 : 2 Time(s)

A total of 1 sites probed the server
81.MYFIXEDIP.00

!!!! 139 possible successful probes
/SQL_Admin/ HTTP Response 200
...ETC (139x)

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Yeah but does that mean that someone is trying to hack into my system?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

but the ssh is for what?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

about the firewall, I'm getting a router with integrated firewall shortly.... but till then, in the iptables, there are some options:

┌─────────────────┤ Firewall Configuration - Customize ├─────────────────┐
│ │
│ You can customize your firewall in two ways. First, you can select
│ to allow all traffic from certain network interfaces. Second, you │
│ can allow certain protocols explicitly through the firewall. Specify │
│ additional ports in the form 'service:protocol', such as 'imap:tcp'. │
│ │
│ Trusted Devices: [ ] broadcom │
│ │
│ Allow incoming: [ ] SSH [*] Telnet │
│ [*] WWW (HTTP) [*] Mail (SMTP) [*] FTP │
│ Other ports https:tcp pop3:tcp_______ │
│

Should I check eth0 (broadcom) as trusted device or should I only check the ports? About mysql, its using sockets rather then ports so no prob there

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

OK, I did that, and then tried a probe (www.grc.com) and only the ports I specified are open! --> FIXED

--------------------- POP-3 Begin ------------------------
**Unmatched Entries**
could not getenv(CYRUS_SERVICE); exiting: 1 Time(s)

^^^^^^^^^^^^^ what does that mean?

!!!! 139 possible successful probes
/SQL_Admin/ HTTP Response 200
...ETC (139x)

This is a program that is run localy on my server. But how come it mentiones this in the log? (possible successful probes) HTTP 200 = OK ?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

could not getenv(CYRUS_SERVICE); exiting: 1 Time(s)

I found out what was wrong:

http://docsrv.sco.com:8457/en/doc/packages/scomsg/en/cyrus-imapd/install-configure.html#master

Look at the line just above:

12. Remove "/etc/[x]inetd.conf" entries. Any imap, imaps, pop3, pop3s, kpop, lmtp and sieve lines need to be removed from /etc/[x]inetd.conf and [x]inetd needs to be restarted

Also, I had put an entry destined for inetd.conf into xinetd.conf

PROBS FIXED:
1. Security --------------- OK
2. Cyrus ---------------- OK
3. Kernel: NOT FIXED:
WARNING: Kernel Errors Present
vesafb: probe of vesafb0 failed with error -6...: 5 Time(s)

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

____________________________
No, this occured on a clean install
======================

what is the vesafb probe in fact?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

So what should I do with it... Ignore?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Well my X is working fine. .. .. ..

Well Wesley

I wish to thank you (again) for your efforts in bringing light on dark places in Linux...

I know I will call upon your services again before long... hopefully will you be able to respond.

Until then

With kindest regards

Ramses