topic Re: Error messages in syslog in Operating System - HP-UX

Error messages in syslog

Charles Campbell — Fri, 21 Feb 2003 10:20:29 GMT

At regular intervals I get the followinf message in my syslog log file
rlogind[15726]: Connection from xxx.xx.xx.xx on illegal port.

I have checked the knowledge base but have not come up with an answer. Can anybody help

Thanks in advance
Charles Campbell

Re: Error messages in syslog

Clemens van Everdingen — Fri, 21 Feb 2003 10:30:37 GMT

Hi,

Are you using rlogin through the GSP port of your system ?

This could cause this issue.
Also specific firewall rules could cause this.

C.

Re: Error messages in syslog

Steve Steel — Fri, 21 Feb 2003 10:32:32 GMT

Hi

Do you have a firewall

Some like the eagle raptor can give this

Steve Steel

Re: Error messages in syslog

U.SivaKumar_2 — Fri, 21 Feb 2003 10:51:18 GMT

Hi,

This error is logged if the remote client has selected it's source port as unprivileged port
i.e >1024

This may occur in case of normals users connecting to server or using non-unix rlogin clients or attack attempt
.

regards,

U.SivaKumar

Re: Error messages in syslog

Robert-Jan Goossens — Fri, 21 Feb 2003 10:53:11 GMT

Hi,

look for ftp logins in your syslog,

take a look at next text

What does "500 Illegal PORT Command" mean?
The "Illegal PORT Command" error message is coming from your FTP client. I don't know what it is expecting or what's wrong with what it's hearing. Is this FWTK 2.1? Perhaps you're using one of the older versions of FWTK that sent the PORT command as two separate write() operations - some FTP clients expect to see the PORT and terminating cr/lf in a single packet.

Hope it helps,

Robert-Jan.

Re: Error messages in syslog

Steven E. Protter — Fri, 21 Feb 2003 19:06:12 GMT

Might want to update logging on certain /etc/inetd.conf daemons.

the one in there named ftpd can have -l command added for better logging.

save the file

inetd -c to reload, you get better ftp logging.

For security reasons, I recommend dropping the Berkely protocols (rlogin), by commenting them out of inetd.conf

They can be replaced with secure shell, link and setup doc attached.
https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=T1471AA&date=

You might want to consider the next two links. Security hardening tool, Bastille, ported from Linux and a real time saver.

https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=B6849AA&date=

Another handy tool is Security patch check.
link:https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=B6834AA&date=

Good luck and stop using the Berkely protocols, which transmit passwords around in clear text. Secure shell totally and securely replaces those tools. They are available on the PC as well.

SEP

Re: Error messages in syslog

Charles Campbell — Mon, 24 Feb 2003 15:49:11 GMT

Hi all,

Thanks for the response. Further down the syslog log file the following apprears

Jan 27 02:21:27 server ftpd[15739]: FTP session closed
Jan 27 02:21:28 server ftpd[15741]: FTP session closed
Jan 27 02:21:33
Jan 27 02:31:22 serve tftpd[15736]: Timeout (no requests in 10 minutes)
Jan 27 02:36:15 server ftpd[15721]: exiting on signal 14

The host name listed is on our internal lan and the server is behind a firewall.

I am also getting bootp requests but do not have DHCP set-up on our network.

Re: Error messages in syslog

Jeff Schussele — Mon, 24 Feb 2003 15:56:21 GMT

Hi Charles,

To get rid of the bootp requests - comment out
#tftp .....
#bootps .....
in /etc/inetd.conf & run
inetd -c

You're system will no longer accept & log these connection attempts.

HTH,
Jeff