[ILUG] "Admin prohibited filter"

[kevin lyda]

John Kelly wrote:
> 
> Heyas,
> I'm connected to esat surf nolimits for all of the time that it's still
> cheap, and I've noticed recently that there's been an awful lot of people
> checking out/attacking my box, even if I'm away from the computer, and
> it's not doing anything but getting my mail every 5 minutes.
> These are usually brute-force and common cgi expl0its, which normally end
> up with the person trying to "nuke" me out of frustration.
> Now, I don't usually worry about these, nor do I usually take any action
> when I see them (script kiddies will be script kiddies), but last night I
> got something in my tcpdump logs that I hadn't seen before.  From about
> 1am till 5am, every half hour, I got an entry like this :
> 
> 00:44:20.137989 165.21.XX.XXX > 194.145.131.102: icmp: host 155.69.X.XXX
> unreachable - admin prohibited filter
> 
> (The uncensored IP address was my own dialup address)
> 
> This has me worried, mostly because it's something new.  I also noticed
> before I left for work that there were some mails in my mail queue, which
> certainly weren't mine.  I doubt this would be sendmail relaying stuff,
> would it?  The box is a fairly vanilla OpenBSD box, with no changes to the
> default sendmail.cf file.
> 
> Could anyone shed any light on this?

try searching the openbsd source for that error message.  maybe a
comment near it will be enlightening?  (ie  use the source luke...)

kevin
-- 
kevin at suberic.net       "we were goin' for breakfast.  in canada.  we
fork()'ed on 37058400    made a deal: if she'd stop hookin', i'd stop
meatspace place: home    shootin' people.  maybe we were aiming high."
                                                   --porter, "payback"