OK, I've been looking at my logs file and someone is trying to break in my system, This is what I see:

/var/log/messages
xinetd[536]: refused connect from 217.x.x.x <-- I get several of these messages from this IP, I tried to do a nslookup but I can't find anything back, I try to ftp or telnet, but I think its from a Windows machine.

/var/log/secure
xinetd[534]: FAIL: ftp libwrap from=217.x.x.x
in.ftpd[11707]: refused connect from 217.x.x.x

What can i do to keep this guy out? What is he trying to do? What does "FAIL: ftp libwrap" mean?

Please help!!!

seems as if someone is trying to telnet or ftp into your ip, might just have the wrong ip.
unless he has a user name and account, he won't get in. you could setup your iptables or ipchains to refuse connection all together from that ip.. that would work.

If he shows up against multiple daemons, its probably just a portscan of sorts. One of the easiest ways to block someone off is to stick their fully qualified hostname, or I'm certain IP will work in /etc/hosts.deny, that's if your machine is set up to use this cute little feature of inetd, which is pretty much every distro release since RedHat hit the 6's. This may not help much as most of the world runs off of dynamic IPs, so his would change.

If you're really curious about him, you may wish to install and use nmap to figure out what OS he is running, what ports he has open, blah blah blah which is probably just what he did to you.

You may also want to post this instead in the security forum as most of the regulars there don't often wander over here into Networking, and I really don't know dink about security.

Luck,

Finegan

Well the good thing is that I have tcpwrappers, I do have a hosts.allow and a hosts.deny. I only allow myself to ssh from my office but you never know what someone is trying to do. I thought I had clicked on the security forum but I guess I didnt click careful enough. SOrry, Should i tell the moderator to put it in the security one? And thanks for the info!

I just checked and realized that UnSpawn, who has probably forgotten more about security than I would ever care to learn, moderates this forum now too... he'll probably post in reply to this sometime shortly with some better advice, or you could ask him to re-locate the thread, or you could mail him directly about your query of course... but I'd suggest the middle route as it will keep the discussion in an open forum that people could search through later.

Double posting here is considered really improper, I feel silly now for having suggested it, thank you for politely pointing out my error.

Also, searching by "attempted and hack" through the archives brought back a ton.

Cheers,

Finegan