[email protected] wrote: > Yesterday someone "attacked" by box by connection to several ports.. In > other words, a simple portscan.. yet, since my box has "log_in_vain" > enabled, so it tries to log everything to /var/log/messages, [ ... ] > Isn't this a quite simple way of making a DoS attack against a system? Certainly turning on log_in_vain makes it easier to DoS a system, but it's possible to perform a DoS against anything if someone tries hard enough. Basicly, log_in_vain can be used to turn a system into a network sensor which tracks incoming connection requests. Normally, one has a firewall in place which blocks the majority of ports used by a port scan, and your sensor only detects the remainder-- ie, what you let through, in addition to any local traffic. Seeing your sensor get horribly busy like you did tends to indicate you're monitoring unfiltered Internet traffic (or your firewall is busted), in which case be prepared to possibly deal with hundreds of thousands of lines of logging per day. Or it indicates an internal machine has been virusized and is scanning the local subnet for other hosts to infect (or someone connecting a laptop to your network, etc). I've been seeing about 500 connection attempts per day per monitored IP address. For what it's worth, you provoked my curiousity enough to see what the last week looks like in terms of a histogram by port #: % zcat /var/log/system.log.*.gz | grep 'TCP.* S' | awk -F: '{print $7}' \ | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -30 20654 1433 4622 4444 4458 445 3451 135 3189 139 2455 80 448 6129 270 3127 140 2745 124 4000 96 21 87 4899 80 1025 79 1080 65 5000 58 3128 41 20168 41 1981 34 25 28 3410 26 36442 23 23 17 22 15 443 13 32772 13 113 7 81 7 8000 6 8080 5 901 -- -Chuck _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"