- WLUG - wlug.mailman3.com

Re: [Wlug] Advise Needed

by Scott Venier

If your machien has been broken into, the only way to clean it up is to reformat and reinstall. They cannot trust any binary left on the system (including the kernel) so you won't truely know when you've cleaned it up. Scott On Wed, 1 May 2002, Michael Long wrote: > It appears that my computer has been hacked into. The following > services are run periodically throughout the day. How do I go about > finding out what is starting and stopping them and more importantly > prevent them from being run. > > I have a hardware firewall between the computer and isp. > > 17762 root sh -c (safe_finger -l @64.213.97.247 > 2>&1| /bin/mail -s "in.ftpd-64.213.97.247 unknown" root) > & > 17763 nobody safe_finger -l @64.213.97.247 > 17764 root /bin/mail -s in.ftpd-64.213.97.247 unknown root > 17765 nobody finger -l 64.213.97.247 > 17768 root /usr/sbin/sshd > 17770 root sh -c (safe_finger -l @::ffff:64.213.97.247 > 2>&1| /bin/mail -s "sshd-::ffff:64.213.97.247 unknown" > root) & > 17771 nobody safe_finger -l @::ffff:64.213.97.247 > 17772 root /bin/mail -s sshd-::ffff:64.213.97.247 unknown root > 17773 nobody finger -l ::ffff:64.213.97.247 > > Thanks, > Mike > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

May 2, 2002

Advise Needed

by Michael Long

It appears that my computer has been hacked into. The following services are run periodically throughout the day. How do I go about finding out what is starting and stopping them and more importantly prevent them from being run. I have a hardware firewall between the computer and isp. 17762 root sh -c (safe_finger -l @64.213.97.247 2>&1| /bin/mail -s "in.ftpd-64.213.97.247 unknown" root) & 17763 nobody safe_finger -l @64.213.97.247 17764 root /bin/mail -s in.ftpd-64.213.97.247 unknown root 17765 nobody finger -l 64.213.97.247 17768 root /usr/sbin/sshd 17770 root sh -c (safe_finger -l @::ffff:64.213.97.247 2>&1| /bin/mail -s "sshd-::ffff:64.213.97.247 unknown" root) & 17771 nobody safe_finger -l @::ffff:64.213.97.247 17772 root /bin/mail -s sshd-::ffff:64.213.97.247 unknown root 17773 nobody finger -l ::ffff:64.213.97.247 Thanks, Mike

May 1, 2002

Advise Needed

by Michael Long

It appears that my computer has been hacked into. The following services are run periodically throughout the day. How do I go about finding out what is starting and stopping them and more importantly prevent them from being run. I have a hardware firewall between the computer and isp. 17762 root sh -c (safe_finger -l @64.213.97.247 2>&1| /bin/mail -s "in.ftpd-64.213.97.247 unknown" root) & 17763 nobody safe_finger -l @64.213.97.247 17764 root /bin/mail -s in.ftpd-64.213.97.247 unknown root 17765 nobody finger -l 64.213.97.247 17768 root /usr/sbin/sshd 17770 root sh -c (safe_finger -l @::ffff:64.213.97.247 2>&1| /bin/mail -s "sshd-::ffff:64.213.97.247 unknown" root) & 17771 nobody safe_finger -l @::ffff:64.213.97.247 17772 root /bin/mail -s sshd-::ffff:64.213.97.247 unknown root 17773 nobody finger -l ::ffff:64.213.97.247 Thanks, Mike

May 1, 2002

Re: [Wlug] Returned mail: see transcript for details (fwd)

by Theo Van Dinter

On Tue, Apr 30, 2002 at 03:42:11PM -0400, Michelle Vadeboncoeur wrote: > can anyone determine from the status codes what software the Reporting-MTA > is? Maybe the reason is hidden in that code. Your mysterious > non-delivery generated a Status: 5.0.0 Status 5.0.0 is a generic error code in SMTP. > besides the status codes being different, it's my server rejecting the > email, and not a response from hotmail. Correct, the bounce will occur from the last mail server to receive the message on the journey. In your case, hotmail denied the mail at the point where they were receiving the message, so your sending server bounces the message back to you. The other bounce message (that we're actually talking about) seems to come from inside hotmail itself, but it gives no information other than: Reporting-MTA: dns;hotmail.com Received-From-MTA: dns;dc-mx04.cluster1.charter.net Final-Recipient: rfc822;kamikaze003(a)hotmail.com Action: failed Status: 5.0.0 So we know that "hotmail.com" (and who knows what server that actually is) thought it could deliver the mail, so it accepted it, but ended up unable to deliver the message for unknown reasons (no description given), so it bounced back to the sender. I don't see how this problem would have any relation to Charter, Linux, pine, etc. It seems to be very much a Hotmail specific issue. I'd start bugging postmaster(a)hotmail.com to be honest. There's not much else to do. :( -- Randomly Generated Tagline: "I know that, you know that, but kids just don't make news unless they're arrested for drugs, gangs, or some form of violence..." - Michelle "or sports..." - Theo's response

April 30, 2002

Returned mail: see transcript for details (fwd)

by Michelle Vadeboncoeur

can anyone determine from the status codes what software the Reporting-MTA is? Maybe the reason is hidden in that code. Your mysterious non-delivery generated a Status: 5.0.0 for a comparison returned email, I send a test message to a friend's inactive hotmail account (disabled for lack of use). I sent it using Pine on a linux box running sendmail. sorry, I'm not on charter so I can't completely replicate things... besides the status codes being different, it's my server rejecting the email, and not a response from hotmail. ---------- Forwarded message ---------- >From MAILER-DAEMON(a)kluge.net Tue Apr 30 15:34:51 2002 Date: Tue, 30 Apr 2002 15:24:23 -0400 From: Mail Delivery Subsystem <MAILER-DAEMON(a)kluge.net> To: mrv(a)eclectic.kluge.net Subject: Returned mail: see transcript for details The original message was received at Tue, 30 Apr 2002 15:24:21 -0400 from mrv@localhost ----- The following addresses had permanent fatal errors ----- <outlaweagle(a)hotmail.com> (reason: 550 Requested action not taken:user account inactive) ----- Transcript of session follows ----- ... while talking to mx09.hotmail.com.: >>> RCPT To:<outlaweagle(a)hotmail.com> <<< 550 Requested action not taken:user account inactive 550 5.1.1 <outlaweagle(a)hotmail.com>... User unknown [ Part 2: "Delivery Status" ] Reporting-MTA: dns; eclectic.kluge.net Arrival-Date: Tue, 30 Apr 2002 15:24:21 -0400 Final-Recipient: RFC822; outlaweagle(a)hotmail.com Action: failed Status: 5.1.1 Remote-MTA: DNS; mx09.hotmail.com Diagnostic-Code: SMTP; 550 Requested action not taken:user account inactive Last-Attempt-Date: Tue, 30 Apr 2002 15:24:22 -0400 Return-Path: <mrv(a)eclectic.kluge.net> Received: from localhost (mrv@localhost) by eclectic.kluge.net (8.11.6/8.11.6) with ESMTP id g3UJOL702343 for <outlaweagle(a)hotmail.com>; Tue, 30 Apr 2002 15:24:21 -0400 Date: Tue, 30 Apr 2002 15:24:20 -0400 (EDT) From: Michelle Vadeboncoeur <mrv(a)eclectic.kluge.net> To: craig roberts <outlaweagle(a)hotmail.com> Subject: testing Message-ID: <Pine.LNX.4.44.0204301524100.27941-100000(a)eclectic.kluge.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII

April 30, 2002

Re: [Wlug] Mail delivery problems

by Chuck Homic

On Tue, Apr 30, 2002 at 02:56:09PM -0400, Bill Mills-Curran wrote: > This is an automatically generated Delivery Status Notification. > > Delivery to the following recipients failed. > > kamikaze003(a)hotmail.com Riiiiight.... ok. -Chuck

April 30, 2002

Mail delivery problems

by Bill Mills-Curran

Sorry for the misleading initial description of the problem. Here's what hotmail has been sending me. Bill ---------- Forwarded message ---------- Date: Tue, 30 Apr 2002 09:50:33 -0700 From: postmaster(a)mail.hotmail.com To: subssn594(a)charter.net Subject: Delivery Status Notification (Failure) This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. kamikaze003(a)hotmail.com

April 30, 2002

Re: [Wlug] problems with email to hotmail.com

by Chuck Homic

On Tue, Apr 30, 2002 at 02:32:30PM -0400, Bill Mills-Curran wrote: > It's only hotmail that's the issue. I am sending lots of my email to > multiple recipients, and it's only hotmail that's complaining. And, > note that the mail gets to the hotmail servers, because it is the > hotmail agents that are informing me of the failed delivery. I assume by "complaining" and "informing" you mean a bounce message. Why don't you share the bounce? It might give us half a clue. -Chuck

April 30, 2002

Re: [Wlug] problems with email to hotmail.com

by Theo Van Dinter

On Tue, Apr 30, 2002 at 02:32:30PM -0400, Bill Mills-Curran wrote: > It's only hotmail that's the issue. I am sending lots of my email to > multiple recipients, and it's only hotmail that's complaining. And, > note that the mail gets to the hotmail servers, because it is the > hotmail agents that are informing me of the failed delivery. > > Thus, I don't think it's Charter that's the real bad player. (Note > that I can get the mail delivered if I use the Charter web email > client.) I think it's an issue of hotmail not liking the delivery > path from my linux box hiding behind a firewall. What's the bounce message look like? I thought you were having problems sending them mail, meaning you were getting "mail hasn't been delivered for 4 hours, continuing for 5 days" type issue. Getting bounces involves a completely different set of problems. -- Randomly Generated Tagline: "Bread has been proven to absorb water. Since the human body is more than 90 percent water, it follows that eating bread could lead to your body being taken over by this absorptive food product, turning you into a soggy, gooey bread-pudding person." - http://www.geoffmetcalf.com/bread.html

April 30, 2002

Re: [Wlug] problems with email to hotmail.com

by Bill Mills-Curran

On Tue, 30 Apr 2002, Chuck Homic wrote: > Date: Tue, 30 Apr 2002 14:41:44 -0400 > From: Chuck Homic <chuck(a)vvisions.com> > Reply-To: wlug(a)mail.wlug.org > To: wlug(a)mail.wlug.org > Subject: Re: [Wlug] problems with email to hotmail.com > > On Tue, Apr 30, 2002 at 02:32:30PM -0400, Bill Mills-Curran wrote: > > It's only hotmail that's the issue. I am sending lots of my email to > > multiple recipients, and it's only hotmail that's complaining. And, > > note that the mail gets to the hotmail servers, because it is the > > hotmail agents that are informing me of the failed delivery. > > I've had a similar problem a couple years ago with sending mail to Juno. > It sent me a bounce that complained I wasn't an MX. So I had to start > using RCN's cr4ppy-a55 SMTP server, which was down every other day and > waited 2 hours before relaying my mail. :( > > -Chuck > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > Chuck, I suspected the same, but changing pine to use the Charter smtp server directly didn't help. Bill

April 30, 2002