OSR 5.0.7 need to block a specific IP

UNIX SCO
1

There are huge number of messages in syslog suggesting one of the client's IP is trying to telnet/ssh/pop/imap into the OSR5.0.7 system, it happens every minute or so, see a snippet below

Oct  9 13:11:20 myhost popper[17507]: (null) at 192.168.1.123 (192.168.1.123): -ERR POP EOF or I/O Error: 25 (Inappropriate I/O control operation); 0 (Unknown error)
Oct  9 13:11:23 myhost imapd[17517]: Unknown error, while reading line user=??? host=192.168.1.123
Oct  9 13:11.123 myhost telnetd[17521]: ttloop:  peer died: Unknown error 
Oct  9 13:11:34 myhost sshd[17525]: Did not receive identification string from 192.168.1.123
Oct  9 13:11:50 myhost popper[17540]: (v3.0.2-scoR5) Unable to get canonical name of client 192.168.1.123: Authoritive answer: Host not found (1)
Oct  9 13:11:50 myhost popper[17540]: EOF from  at 192.168.1.123 (192.168.1.123): [0] 25 (Inappropriate I/O control operation); 0 (Unknown error)
Oct  9 13:11:50 myhost popper[17540]: (null) at 192.168.1.123 (192.168.1.123): -ERR POP EOF or I/O Error: 25 (Inappropriate I/O control operation); 0 (Unknown error)
Oct  9 13:11:53 myhost imapd[17542]: Unknown error, while reading line user=??? host=192.168.1.123
Oct  9 13:11:58 myhost telnetd[17554]: ttloop:  peer died: Unknown error 
Oct  9 13:12:04 myhost sshd[17557]: Did not receive identification string from 192.168.1.123

I tried

route add -host 192.168.1.123 reject

but reject option is not understood by OSR route

How do I block that address?

Just in case I show what the system runs:

tcp        0      0  *.netbios-             *.*                    LISTEN
tcp        0      0  *.ipp                  *.*                    LISTEN
tcp        0      0  *.8457                 *.*                    LISTEN
tcp        0      0  *.sco-inet             *.*                    LISTEN
tcp        0      0  *.http                 *.*                    LISTEN
tcp        0      0  *.687                  *.*                    LISTEN
tcp        0      0  *.listen               *.*                    LISTEN
tcp        0      0  *.1024                 *.*                    LISTEN
tcp        0      0  *.submissi             *.*                    LISTEN
tcp        0      0  *.smtp                 *.*                    LISTEN
tcp        0      0  *.ssh                  *.*                    LISTEN
tcp        0      0  *.smux                 *.*                    LISTEN
tcp        0      0  *.swat                 *.*                    LISTEN
tcp        0      0  *.imap                 *.*                    LISTEN
tcp        0      0  *.pop3                 *.*                    LISTEN
tcp        0      0  *.time                 *.*                    LISTEN
tcp        0      0  *.daytime              *.*                    LISTEN
tcp        0      0  *.chargen              *.*                    LISTEN
tcp        0      0  *.discard              *.*                    LISTEN
tcp        0      0  *.echo                 *.*                    LISTEN
tcp        0      0  *.tcpmux               *.*                    LISTEN
tcp        0      0  *.finger               *.*                    LISTEN
tcp        0      0  *.exec                 *.*                    LISTEN
tcp        0      0  *.login                *.*                    LISTEN
tcp        0      0  *.shell                *.*                    LISTEN
tcp        0      0  *.telnet               *.*                    LISTEN
tcp        0      0  *.ftp                  *.*                    LISTEN
tcp        0      0  *.sunrpc               *.*                    LISTEN
2

Why not sort out the problem where it is being created i.e. on 192.168.1.123?

3

Yes, I already contacted client, but their response time is bad, next week or so

4

Try 'ipf'. "man ADMN ipf"

1 Like