It is an attempt to connect to a root shell installed by an exploit in
sendmail/RPC/BIND. It doesn't mean that you've been exploited, only that
somebody is searching to see if that backdoor has been installed.
I've written a good document that describes these sorts of things at:
http://www.robertgraham.com/pubs/firewall-seen.html#port1524
Rob.
-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTS_at_securityfocus.com]On
Behalf Of Dino Amato
Sent: Sunday, March 05, 2000 5:34 PM
To: INCIDENTS_at_securityfocus.com
Subject: ingreslock message
I logged this:
Mar 5 15:58:23 monitor tcplogd: ingreslock connection attempt from
unknown_at_sleipnir1.cs.ucl.ac.uk
what does the ingreslock mean and what was this person trying to do?
Thanks
--------------------------------------------
Dino Amato
Systems Administrator
------------------------------------------
Received on Mar 07 2000
Intro
