Current time: 11-25-2024, 02:50 PM Hello There, Guest! (LoginRegister)


Post Reply 
firewall blocks ispcp server due to portscans
Author Message
organiccode Offline


Posts: 1
Joined: Mar 2011
Reputation: 0
Post: #1
firewall blocks ispcp server due to portscans
Hi,

Installed ispCP 1.0.7 as usual on a brand new Debian 5.0. No special configs so far, works great. Its meant to be used as an internal dev server. However there is a problem with the firewall (watchguard). It registers portscans coming from the machine and blocks it from the net.

Is it possible that one of the services utilized by ispCP creates anything that could be or look like a portscan? Yes, nmap and hping are installed, both of which can be used to scan ports. Yet I'm the only user on the machine, therefore would know about their usage.

Thanks for any hint you might have Smile

cu
Roman
03-15-2011 07:24 PM
Find all posts by this user Quote this message in a reply
kilburn Offline
Development Team
*****
Dev Team

Posts: 2,182
Joined: Feb 2007
Reputation: 34
Post: #2
RE: firewall blocks ispcp server due to portscans
No, ispcp should not be scanning anything except the machine itself (to show which ports are open in the ports page). Since these are local connections, they should not hit your firewall and trigger any rules.

Therefore, I suspect that your machine might be infected by some kind of rootkit. Have you inspected the output of rkhunter?
03-20-2011 04:31 AM
Visit this user's website Find all posts by this user Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)