port scan from proxmox

[peterwynne]

One of our mail servers sits behind a firewall.
Yesterday we had a possible hack incident, so I've been checking through our firewall log.

It shows a port scan from the proxmox to our mail server. [see below]

09/19/2008 09:32:49.176 Alert Intrusion Prevention Possible port scan detected PROXMOXIPADDRESS, 34820, WAN FIREWALLADDRESS, 17641, WAN TCP scanned port list, 17612, 17605, 17592, 17630, 17635

This showed up a number of times yesterday also. Does anyone know why this might be?

 

[dietmar]

To be on the safe side, it is maybe easier to reinstall the machine.

- Dietmar

 

[peterwynne]

thats a bit worrying!

I was hoping someone would have some reasonable explanation.

 

[tom]

thats a bit worrying!

I was hoping someone would have some reasonable explanation.

Proxmox Mail Gateways does not do any port scanning, so either you got a false alarm from your firewall which we cannot verify or someone compromised your server which we also cannot verify.

If someone got your root account, everything is possible.

Anyway, if you trust your firewall log than you have to reinstall your Proxmox server to eliminate any risk - Backup your setting and do a restore afterwards (15 minutes work).

Make sure that you use a quite secure root password and that you protect the Proxmox Server with a firewall.