hjnet

Registered
Mar 5, 2002
3
0
301
I´m getting belows email every day

Active System Attack Alerts
=-=-=-=-=-=-=-=-=-=-=-=-=-=
May 22 23:58:07 server1 portsentry[1193]: attackalert: Connect from host: cm61-10-9-171.hkcable.com.hk/61.10.9.171 to TCP port: 111
May 22 23:58:12 server1 portsentry[1193]: attackalert: Connect from host: cm61-10-9-171.hkcable.com.hk/61.10.9.171 to TCP port: 111
May 22 23:58:12 server1 portsentry[1193]: attackalert: Host: 61.10.9.171 is already blocked. Ignoring

and nearly at the same time, the whole server went offline and keeps offline until I restart it manually.
 

haze

Well-Known Member
Dec 21, 2001
1,550
3
318
Looks like someone scanning your server. I get these everyday.
 

hjnet

Registered
Mar 5, 2002
3
0
301
I´ve heard that it is useful to close all unused ports. Any Idea how I can do this??
 

haze

Well-Known Member
Dec 21, 2001
1,550
3
318
With IPchains, which is probably already installed on your server.