Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs

Commands Run:
User root:
   /sbin/service portsentry restart >/dev/null && /sbin/service iptables restart >/dev/null: 72 Time(s)

Then the portsentry log is:

--------------------- PortSentry Begin ------------------------ 


 Ignored following ports
Advanced Stealth:
   TCP: ports: 21-22 25 53 80 110-111 113 135 137-139 443 932

Excluded following ports
Advanced: ports: 21-22 25 53 80 110 113 135 137-139 443

**Unmached entries**
72 Time(s): adminalert: Advanced mode will monitor first 1024 ports
72 Time(s): adminalert: ERROR: Socket 111 is in use and will not be monitored. Attempting to continue
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 1
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 111
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 137
72 Time(s): adminalert: Going into stealth listen mode on UDP port: 138
etc etc ......   then
144 Time(s): adminalert: PortSentry 1.2 is starting.
144 Time(s): adminalert: PortSentry is shutting down
144 Time(s): securityalert: PortSentry is shutting down

 ---------------------- PortSentry End ------------------------- 

I am a little puzzled to say the least, if i log on and start portsentry manually i get an okay for the close and an okay for the start, so i can get it to run, just cant seem to stop it from starting and stopping after that.

I have looked in crontab and there is no repeating entry for the first section [ commands run] this log is from cron.

If anyone else has come accross this, or can give me a clue then that would be great.

thanks

share|improve this question
add comment

1 Answer 1

111 is most propably the portmap daemon. Why is that beast running on your server at all?

If you need it because of the need for an NFS-client use

PMAP_ARGS="-l"

In /etc/sysconfig/portmap

That will bind it to localhost.

share|improve this answer
    
that's not an answer to the question but thankks for the advice –  minus4 Jan 24 '12 at 11:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.