Re: ingreslock message

On Sun, 5 Mar 2000, Dino Amato wrote:
> I logged this:
> Mar 5 15:58:23 monitor tcplogd: ingreslock connection attempt from unknown_at_sleipnir1.cs.ucl.ac.uk
> what does the ingreslock mean and what was this person trying to do?
> Thanks

The ingresslock port is 1524 (I think). It has been used recently
as a backdoor by some intruders. They add a line to inetd.conf to
accept connections on 1524.

This person may have been looking for systems that have been broken.

Eric

---------------------------------------------------------------------
Eric Maiwald emaiwald_at_fred.net
So Many Hobbies, So little time
---------------------------------------------------------------------
Received on Mar 07 2000