<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff size=4>I did
a:</FONT></SPAN></DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4>service vsftpd stop</FONT></SPAN></DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4>service vsftpd start</FONT></SPAN></DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4></FONT></SPAN> </DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff size=4>and
the non-stop hacking on vsftpd stopped. Could be one of 2 things, either this
solved my problem permanently, or stopping the service for a few seconds caused
his automatic hack program to hang. Dunno which for now, nor know how to tell
which did it. Is stuff nuked by hosts.deny logged somewhere?</FONT></SPAN></DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4></FONT></SPAN> </DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4>Thanks for you help!</FONT></SPAN></DIV>
<DIV><SPAN class=921394919-28032006><FONT face=Tahoma color=#0000ff
size=4>Bill</FONT></SPAN></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT
face=Tahoma size=2>-----Original Message-----<BR><B>From:</B>
rhn-users-bounces@redhat.com [mailto:rhn-users-bounces@redhat.com] <B>On
Behalf Of </B>Kvetch<BR><B>Sent:</B> Tuesday, March 28, 2006 11:26
AM<BR><B>To:</B> Red Hat Network Users List<BR><B>Subject:</B> Re: [rhn-users]
I need help with hosts.deny - doesn't work asIexpected<BR><BR></FONT></DIV>tcp
wrappers are automatic and no service needs restarting. Try restarting
vsftd then try again.<BR>If you have nothing in your hosts.allow and in your
hosts.deny you have<BR><BR><SPAN class=q id=q_10a423a771223cfe_2>ALL: <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://219.106.229.178/" target=_blank>219.106.229.178</A><BR>ALL:<SPAN
style="TEXT-DECORATION: underline"> </SPAN><A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://72.129.200.46/" target=_blank>72.129.200.46</A><BR>ALL:
200.38.<BR>ALL: 64.182.</SPAN><BR><BR>It should block them.<BR>Can you
retest?<BR>Nick Baronian<BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 3/28/06, <B class=gmail_sendername>Bill
Watson</B> <<A
href="mailto:bill@magicdigits.com">bill@magicdigits.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV style="DIRECTION: ltr">
<DIV><SPAN><FONT face=Tahoma color=#0000ff size=4>Yes I do have
tcp_wrappers=YES in vsftpd.conf</FONT></SPAN></DIV></DIV>
<DIV style="DIRECTION: ltr"><SPAN class=sg>
<DIV><SPAN><FONT face=Tahoma color=#0000ff size=4></FONT></SPAN> </DIV>
<DIV><SPAN><FONT face=Tahoma color=#0000ff
size=4>Bill</FONT></SPAN></DIV></SPAN></DIV>
<DIV style="DIRECTION: ltr"><SPAN class=q id=q_10a423a771223cfe_2>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV lang=en-us dir=ltr align=left><FONT face=Tahoma size=2>-----Original
Message-----<BR><B>From:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:rhn-users-bounces@redhat.com"
target=_blank>rhn-users-bounces@redhat.com</A> [mailto:<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:rhn-users-bounces@redhat.com" target=_blank>
rhn-users-bounces@redhat.com</A>] <B>On Behalf Of
</B>Kvetch<BR><B>Sent:</B> Tuesday, March 28, 2006 10:56 AM<BR><B>To:</B>
Red Hat Network Users List<BR><B>Subject:</B> Re: [rhn-users] I need help
with hosts.deny - doesn't work as Iexpected<BR><BR></FONT></DIV>Do you
have <BR>tcp_wrappers=YES<BR>in your vsftpd.conf?<BR><BR>Nick
Baronian<BR><BR>
<DIV><SPAN class=gmail_quote>On 3/28/06, <B class=gmail_sendername>Bill
Watson</B> <<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:bill@magicdigits.com" target=_blank>bill@magicdigits.com
</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">I
have /etc/hosts.allow that has no entries. I have /etc/hosts.deny that
<BR>has:<BR><BR>ALL: <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://219.106.229.178" target=_blank>219.106.229.178</A><BR>ALL:
<A onclick="return top.js.OpenExtLink(window,event,this)"
href="http://72.129.200.46" target=_blank>72.129.200.46</A><BR>ALL:
200.38.<BR>ALL: 64.182.<BR><BR>>From my readings, I should not be
getting any messages from 200.38.x.x, yet<BR>my /var/log/messages
shows:<BR>Mar 28 10:50:36 helmethouse vsftpd(pam_unix)[23790]: check
pass; user<BR>unknown<BR>Mar 28 10:50:36 helmethouse
vsftpd(pam_unix)[23790]: authentication failure;<BR>log<BR>name= uid=0
euid=0 tty= ruser= rhost=<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://200.38.16.6" target=_blank>200.38.16.6</A><BR>Mar 28
10:50:40 helmethouse vsftpd(pam_unix)[23790]: check pass;
user<BR>unknown<BR>Mar 28 10:50:40 helmethouse vsftpd(pam_unix)[23790]:
authentication failure; <BR>log<BR>name= uid=0 euid=0 tty= ruser=
rhost=<A onclick="return top.js.OpenExtLink(window,event,this)"
href="http://200.38.16.6" target=_blank>200.38.16.6</A><BR><BR>And keeps
going with a new entry every few seconds.<BR><BR>Is /etc/hosts.deny
properly set up?<BR>Is /etc/hosts.deny immediately active or must some
service be restarted to <BR>make it go?<BR>Does vsftpd bypass
/etc/hosts.deny?<BR><BR>Thanks!<BR>Bill Watson<BR><A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:bill@magicdigits.com"
target=_blank>bill@magicdigits.com</A><BR><BR><BR>_______________________________________________
<BR>rhn-users mailing list <BR><A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:rhn-users@redhat.com"
target=_blank>rhn-users@redhat.com</A><BR><A
onclick="return top.js.OpenExtLink(window,event,this)"
href="https://www.redhat.com/mailman/listinfo/rhn-users"
target=_blank>https://www.redhat.com/mailman/listinfo/rhn-users</A><BR></BLOCKQUOTE></DIV><BR></BLOCKQUOTE></SPAN></DIV><BR>_______________________________________________<BR>rhn-users
mailing list<BR><A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:rhn-users@redhat.com">rhn-users@redhat.com</A><BR><A
onclick="return top.js.OpenExtLink(window,event,this)"
href="https://www.redhat.com/mailman/listinfo/rhn-users"
target=_blank>https://www.redhat.com/mailman/listinfo/rhn-users</A><BR><BR></BLOCKQUOTE></DIV><BR></BLOCKQUOTE></BODY></HTML>