LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 11-17-2003, 01:03 AM   #1
lucastic
Member
 
Registered: Aug 2003
Location: Oz
Distribution: Gentoo - Debian
Posts: 202

Rep: Reputation: 30
Portsentry problems - losing adsl connection


Hello All,

I recently installed portsentry on my Redhat 9 server, to try and secure it a little bit more. It seemed to be doing its job ok, but I noticed after about 3-6 hours when I go to check something on the internet the "host cannot be found" or "name cannot be found". Very strange...

I have had this adsl connection working for months without this problem, everything was fine until portsentry.

I have been getting a high amount of traffic on tcp port 135, which portsentry then blocks. However most of the traffic has come from withtin my service providers network.

I am getting action on port 135 about every 5 minutes.... mostly from comps on the same network as mine, ie the same first three or first two parts of my ip address.



So eventually none of my comps can find www.google.com for example??

When I do traceroute to my nameserver ip it can be found.

I have double checked portsentry.conf and cannot see anything that may be causing this (although I obviously dont know what is causing this problem). In portsentry.ignore I added my local network, nameservers, default gateway etc....

Any ideas anyone.....

Thanks

Lucas
 
Old 11-18-2003, 03:06 PM   #2
DavidPhillips
LQ Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,163

Rep: Reputation: 58
I can only suggest a couple of things to start with. Let us know if it helps.

Setup a script that runs at boot like rc.local that will ping another computer every few seconds to try and keep the connection active.


ping -i 60 ipaddress > /dev/null 2>&1 &


The other suggestion is to stop using portsentry. It's a poor excuse for security. It is better to use a firewall and close ports that you do not need open than to advertise that your system is vunerable trying to fool someone into trying to hack it.

People that know what their doing will not leave any entry in your portsentry log file anyway, and it will invite the idiots that think they know what their doing to keep sending traffic to your system.
 
Old 11-18-2003, 10:50 PM   #3
lucastic
Member
 
Registered: Aug 2003
Location: Oz
Distribution: Gentoo - Debian
Posts: 202

Original Poster
Rep: Reputation: 30
Hi,

Thanks for your reply. I agree portsentry is a poor excuse for internet security... but combined in layers with a iptables and a NIDS its not doing any harm, no?

I think after much searching I have found the cause of the problem.

After port sentry has been running for a few hours my outgoing internet connection dies. I think this is why.

Portsentry is set to flush and restart every 6 hours... the entry in the cron.d script that was restrating it was

00 */6 ***root /sbin/service portsentry restart >/dev/null

ok so far, portsentry would restart as planned...

But then the cron.d script was trying to flush my firewall, but the entry in cron.d was

01 */6 ***root /sbin/service/ iptables restart >/dev/null

when I did iptables -L

my usual rules had dissappeared and the last Lokkit section was full of deny eveything from everywhere! No wonder my connection was dying.

I tried from command line typing /etc/rc.nat iptables restart and bang... my internet connection is working ok and everything is back to normal.

I am still unsure as to the reason why >/dev/null is added to the end of those script lines originally?

Thanks

Lucas
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ADSL connection problems with LinuxOver the last few jutro Linux - Newbie 0 08-05-2004 02:28 PM
adsl connection problems devinWhalen Mandriva 9 07-10-2004 06:53 AM
Adsl connection problems Olle Linux - Newbie 2 11-16-2003 05:37 PM
how to change notification email for portsentry and how to test portsentry roorings Linux - Security 1 11-04-2003 11:36 AM
Losing Connection syxxpac023 Linux - Networking 0 10-11-2001 08:40 AM


All times are GMT -5. The time now is 06:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration