UNIX for Advanced & Expert Users

Hi All

I am running Redhat Linux 8 (kernel version 2.4.18). Sendmail version sendmail-8.12.8-9.80. I am also running portsentry on this box that is serving as a mail + App server (Apache + Jserv).

I run into this message off and on in the maillog section of my LogWatch report...

**Unmatched Entries**
STARTTLS=client, relay=mail.xxx.com., version=TLSv1/SSLv3, verify=FAIL, cipher=DES-CBC3-SHA, bits=168/168: 115 Time(s)
tcpwrappers (mxr01.nyc02.dsl.net, 65.84.81.240) rejection: 3 Time(s)
tcpwrappers (mxr01.hvn01.dsl.net, 209.87.64.79) rejection: 2 Time(s)
tcpwrappers (content119b.lga2.nytimes.com, 199.239.138.72) rejection: 1 Time(s)
...

I checked in the /etc/hosts.deny file and found these rejected IP addresses in it. So, I guess portsentry is putting these IPs in there as there may have been some scanning from there.

I did some digging and found that if I update /et/hosts.allow with:
sendmail: ALL

This will allow all to use sendmail. Should this cause some security concerns for me? Does this message mean that someone is trying to send an e-mail and is getting rejected? Or is someone trying to use my smtp server for spam??

Also can someone explain the meaning of this message:

STARTTLS=client, relay=mail.xxx.com., version=TLSv1/SSLv3, verify=FAIL, cipher=DES-CBC3-SHA, bits=168/168: 115 Time(s)

Thanks!

KS

tcpwrapper will deny any entry in the /etc/hosts.deny file. you or someone in your organisation has configure your tcpwrapper to deny the following

(mxr01.nyc02.dsl.net, 65.84.81.240) rejection: 3 Time(s)
tcpwrappers (mxr01.hvn01.dsl.net, 209.87.64.79) rejection: 2 Time(s)
tcpwrappers (content119b.lga2.nytimes.com, 199.239.138.72) rejection: 1 Time(s)

in your /etc/hosts.deny


/etc/hosts.deny is manually modify onless it scripted or you using cfengine