RE: Telnet Hacker

[Dennis <iseries@xxxxxxxxxxxx>]

To shut down ports, stop the related services.  For example, end TCP servers, such as FTP etc.  But these should be down already if you don't need them.

Point is you CAN (easily) shut down those ports.  NETSTAT will tell you which are open/exposed.
--  
Sent from my Galaxy tablet phone with with K-9 Mail. Please excuse my brevity.

"Chris Bipes" <chris.bipes@xxxxxxxxxxxxxxx> wrote:

> You should lock out their IP address at your firewall.  Also do a
> reverse DNS lookup to see who the ISP is.  Report the hacking to them. 
> They may shut down the account.  And no you cannot shut down a remote
> port.  You exit program is already shutting down their connection
> attempts.  That is great and the most you can really do from the
> iSeries.  
>
> -- 
> Chris Bipes
> Director of Information Services
> CrossCheck, Inc.
>
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rich Loeber
> Sent: Monday, May 16, 2011 12:46 PM
> To: Midrange Systems Technical Discussion
> Subject: Telnet Hacker
>
>   Hello List,
>
> I have a hacker who has been trying once per second for the last
> several
> hours to establish a Telnet connection with my IBM i server.  They are
> cycling through port numbers one at a time.  Our exit point software is
>   preventing them from connecting because they are not coming from an
>   authorized IP address, but I'd like to shut them down earlier in the
>  process.  Is there an easy way to just turn certain port numbers OFF?
>
> I'm running V5R4 on the server.  I looked at port restrictions, but it
>   seems like this is based on user profile for this version of the OS.
>
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.