- WLUG - wlug.mailman3.com

What's the tally for the installfest???

by Keller, Tim

Do we have a rough idea of how many people are going to be in attendance for the installfest? Later, Tim.

Oct. 23, 2002

Re: [Wlug] Restarting ldap by user, not by root!

by Charles R. Anderson

On Wed, Oct 23, 2002 at 05:34:55PM +0700, Aramico wrote: aramico> There is several users are configuring LDAP in my server. aramico> I give them access to modify the LDAP's configuration by giving o+rwx and This is a huge security risk, giving o+rwx. You should create a group and give g+rwx to the group members, or use sudo. aramico> how can i grant the read and write access to the defined directory which aramico> belong to root ? How can I do it ? Use sudo. man sudoers -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Oct. 23, 2002

RH7.0 Hacked

by Richard Goodman

I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick

Oct. 23, 2002

Re: [Wlug] RH7.0 Hacked

by Karl Hiramoto

Did you not run redhat's up2date program? I agree with marc that you should have ftp client access to ftp from that machine to another. On Wed, 23 Oct 2002, Richard Goodman wrote: > I have two RH7.0 and two RH7.3 servers ... it appears that between > 5-6am Tuesday both the 7.0 servers were hacked - identically. They > are on the same ISP and often their firewalls pick up the same scans > and probes. > > I'm no expert, but this is what I think happened. > > The first clue was that I couldn't log in through ssh - got the > message "The program does not understand the servers's version of the > protocol" > > Looking at /var/log/secure I saw: > 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 > then two fails from 127.0.0.1 > I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but > the host.allow/deny were set to only allow ftp from the internal > network and one specified outside IP# > > 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] > 10/22 6:09 Listener created on port 22 > Daemon is running > > Some poking around showed in /etc/ssh > sshd (which should have been approx 200K was 2,621,812 and dated > 10/22, so probably a trojan? > ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had > 10/22 modified dates > > My web server also was not running (or at least serving local pages) > > I accidently rebooted, the web server came back, but ssh did not. > Later I attempted to delete and reinstall sshd. rpm said it couldn't > uninstall because it wasn't there, and couldn't install because it > was there. I think it finally installed with --force, and sshd was > about 186K, but the symptoms were the same > > It turns out that ftp is also now not operational from the internal > network. There is a message about xinetd/ftp in the startup, but its > probably not important at this point > > After the reboot, ps -ax listed: > 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] > > Obviously, I'm going to have to wipe the server (plan to offload a > few .conf and mail config files, firewall script and leave /var/www - > should that be safe?) and will probably load RH7.3 and patches. > > Any comments on what happened, or on rebuilding? The hard drive is > partitioned (a) / (b) /home (c) /var - and /home has only mail files. > If I format (a) and delete some (which?) directories on /var, should > I be ok? Would prefer not to rebuild the /var/www directories if > possible. With ftp and ssh both down, my only way to offload is to > floppies? > > Boy, I miss not having ssh access! > > Dick > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You have an ambitious nature and may make a name for yourself.

Oct. 23, 2002

RE: [Wlug] RH7.0 Hacked

by Marc Hughes

You probably still have ftp or ssh access from that machine, so you can copy your data off of it onto another server. But I'd say your best bet is unplug it from the internet, copy off all your data (not programs!), wipe clean, and reinstall. You never know what kinds of rootkits were installed, and you can't rely on any system info to be accurate since some rootkits are rather advanced. Did you have SSL running without the recent (as in past month or so) patches? -Marc -----Original Message----- From: Richard Goodman [mailto:dick@goodman1.net] Sent: Wednesday, October 23, 2002 9:31 AM To: wlug(a)mail.wlug.org Subject: [Wlug] RH7.0 Hacked I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 23, 2002

Restarting ldap by user, not by root!

by Aramico

HI all, Can u please help me to solve this problem...... There is several users are configuring LDAP in my server. I give them access to modify the LDAP's configuration by giving o+rwx and create the link for LDAP in their home directory. By this they can modify the L:DAP configuration. The big problem is, they always ask me to restart the ldap (/etc/rc.d/init.d/ldap restart), in fact... I'm so bussy.... Talk to the clients..... can my users ( group users ) able to restart the ldap by executing /etc/rc.d/init.d/ldap restart.... how can i grant the read and write access to the defined directory which belong to root ? How can I do it ? --------------------------------------------------- Note : Btw, so sorry about asking you so much low level question...... Thanks.....

Oct. 23, 2002

Re: [Wlug] Using iptables to MASQ the connection to the internet.

by Peter Gutowski

Aramico, I've noticed, since you posts started appearing, that you seem to be asking for help on topics that are generally well-covered on the internet. But perhaps you are new enough to all this (as I was several years ago) that you don't realize that the purpose of forums like this is to add a level of enrichment to the research work that you've (hopefully) already done. It might be a better use of all of our time if you did some of that research yourself and came back with specific questions after having done so. The answer to the question you ask below specifically is answered quite well in HOWTOs that are readily available. I'll infer for a moment that your question is based on your sucessfull installation of RHL8.0 that you were asking about earlier. To find more information about any installed package do... rpm -q <package-name> -i So for your iptables question, I'd do this: rpm -q iptables -i Among the info listed here is a key to finding out how to use it: URL: : http://www.netfilter.org If you were to follow that link, you'll find plenty of answers to the exact question your pose. (Scroll to the bottom of the page and select NAT HOWTO. Look for "4.1 I just want masquerading! Help!" ) Also, most RPMs have a certain amout of enclosed documentation that will vary in its helpfulness. Do a rpm -q <package-name> -l | grep doc or substitute "info" or "man" for the "doc" above. Making an attempt to read those would also be a good first step to implementing new facilities on systems you are using. You might be pleasantly surprized about how many of these questions have been already anticipated *and* answered! Finally, doing a google search (http://www.google.com) might also surprize you pleasantly about locating these resources quickly. On 10/23/2002 12:23 AM, Aramico <aramico(a)duahati.com> wrote: >Hi all, > >Can you please tell me what is the sysntax of iptables to masquerade >my >network connection to the internet ? > >Basicly, I've only done this to masquerade my network connectionto >the >Internet, as default we can use the computer who masq the connection >as >gateway. >ipchains -A forward -s 0/0 -d 0/0 -j MASQ > >So, can you please tell me what is the syntax of iptables to produce >the >result as the command above...... ? > >Thanks ...... > > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug > >

Oct. 23, 2002

Using iptables to MASQ the connection to the internet.

by Aramico

Hi all, Can you please tell me what is the sysntax of iptables to masquerade my network connection to the internet ? Basicly, I've only done this to masquerade my network connectionto the Internet, as default we can use the computer who masq the connection as gateway. ipchains -A forward -s 0/0 -d 0/0 -j MASQ So, can you please tell me what is the syntax of iptables to produce the result as the command above...... ? Thanks ......

Oct. 23, 2002

Can you trust your computer?

by Karl Hiramoto

I went to see stallman at the book store last wednesday, and this is what he was talking about.... http://newsforge.com/newsforge/02/10/21/1449250.shtml?tid=19 -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You'd like to do it instantaneously, but that's too slow.

Oct. 23, 2002

Re: [Wlug] debian pkgs

by Josh Huber

brad <maitre(a)ccs.neu.edu> writes: > Do the debian users here know how to install a package into a prefix > directory? For example i want my kde stuff to be installed in > /usr/local/kde, not /usr. Is this possible with aptitude? No, you cannot install the packge into another prefix. Well, without rebuilding them, that is :) Typically, you would install locally built packages in /usr/local, while the official packages would live in the standard /usr prefix. -- Josh Huber

Oct. 22, 2002