- WLUG - wlug.mailman3.com

RE: [Wlug] RH7.0 Hacked
by Marc Hughes Oct. 23, 2002

Oct. 23, 2002

You probably still have ftp or ssh access from that machine, so you can copy your data off of it onto another server. But I'd say your best bet is unplug it from the internet, copy off all your data (not programs!), wipe clean, and reinstall. You never know what kinds of rootkits were installed, and you can't rely on any system info to be accurate since some rootkits are rather advanced. Did you have SSL running without the recent (as in past month or so) patches? -Marc -----Original Message----- From: Richard Goodman [mailto:dick@goodman1.net] Sent: Wednesday, October 23, 2002 9:31 AM To: wlug(a)mail.wlug.org Subject: [Wlug] RH7.0 Hacked I have two RH7.0 and two RH7.3 servers ... it appears that between 5-6am Tuesday both the 7.0 servers were hacked - identically. They are on the same ISP and often their firewalls pick up the same scans and probes. I'm no expert, but this is what I think happened. The first clue was that I couldn't log in through ssh - got the message "The program does not understand the servers's version of the protocol" Looking at /var/log/secure I saw: 10/22 5:34 xinetd fail ftp libwrap from 195.157.17.177 then two fails from 127.0.0.1 I'm running an unpatched wu-ftpd (which I'm sure didn't help me) but the host.allow/deny were set to only allow ftp from the internal network and one specified outside IP# 10/22 5:48 (twice) xinetd start pop3 pid=10804 from 127.0.0.1 [not me-sleeping] 10/22 6:09 Listener created on port 22 Daemon is running Some poking around showed in /etc/ssh sshd (which should have been approx 200K was 2,621,812 and dated 10/22, so probably a trojan? ssh_host_key, ssh_host_key_pub, ssh_random_seed, sshd_config all had 10/22 modified dates My web server also was not running (or at least serving local pages) I accidently rebooted, the web server came back, but ssh did not. Later I attempted to delete and reinstall sshd. rpm said it couldn't uninstall because it wasn't there, and couldn't install because it was there. I think it finally installed with --force, and sshd was about 186K, but the symptoms were the same It turns out that ftp is also now not operational from the internal network. There is a message about xinetd/ftp in the startup, but its probably not important at this point After the reboot, ps -ax listed: 1811 D /sbin/modprobe -s -k block-major 7 [which I could not kill] Obviously, I'm going to have to wipe the server (plan to offload a few .conf and mail config files, firewall script and leave /var/www - should that be safe?) and will probably load RH7.3 and patches. Any comments on what happened, or on rebuilding? The hard drive is partitioned (a) / (b) /home (c) /var - and /home has only mail files. If I format (a) and delete some (which?) directories on /var, should I be ok? Would prefer not to rebuild the /var/www directories if possible. With ftp and ssh both down, my only way to offload is to floppies? Boy, I miss not having ssh access! Dick _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0

Re: [Wlug] Using iptables to MASQ the connection to the internet.
by Peter Gutowski Oct. 23, 2002

Oct. 23, 2002

Aramico, I've noticed, since you posts started appearing, that you seem to be asking for help on topics that are generally well-covered on the internet. But perhaps you are new enough to all this (as I was several years ago) that you don't realize that the purpose of forums like this is to add a level of enrichment to the research work that you've (hopefully) already done. It might be a better use of all of our time if you did some of that research yourself and came back with specific questions after having done so. The answer to the question you ask below specifically is answered quite well in HOWTOs that are readily available. I'll infer for a moment that your question is based on your sucessfull installation of RHL8.0 that you were asking about earlier. To find more information about any installed package do... rpm -q <package-name> -i So for your iptables question, I'd do this: rpm -q iptables -i Among the info listed here is a key to finding out how to use it: URL: : http://www.netfilter.org If you were to follow that link, you'll find plenty of answers to the exact question your pose. (Scroll to the bottom of the page and select NAT HOWTO. Look for "4.1 I just want masquerading! Help!" ) Also, most RPMs have a certain amout of enclosed documentation that will vary in its helpfulness. Do a rpm -q <package-name> -l | grep doc or substitute "info" or "man" for the "doc" above. Making an attempt to read those would also be a good first step to implementing new facilities on systems you are using. You might be pleasantly surprized about how many of these questions have been already anticipated *and* answered! Finally, doing a google search (http://www.google.com) might also surprize you pleasantly about locating these resources quickly. On 10/23/2002 12:23 AM, Aramico <aramico(a)duahati.com> wrote: >Hi all, > >Can you please tell me what is the sysntax of iptables to masquerade >my >network connection to the internet ? > >Basicly, I've only done this to masquerade my network connectionto >the >Internet, as default we can use the computer who masq the connection >as >gateway. >ipchains -A forward -s 0/0 -d 0/0 -j MASQ > >So, can you please tell me what is the syntax of iptables to produce >the >result as the command above...... ? > >Thanks ...... > > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug > >

1 0

debian pkgs
by brad Oct. 23, 2002

Oct. 23, 2002

Hi All, Do the debian users here know how to install a package into a prefix directory? For example i want my kde stuff to be installed in /usr/local/kde, not /usr. Is this possible with aptitude? Thanks, -brad

3 2

Can you trust your computer?
by Karl Hiramoto Oct. 23, 2002

Oct. 23, 2002

I went to see stallman at the book store last wednesday, and this is what he was talking about.... http://newsforge.com/newsforge/02/10/21/1449250.shtml?tid=19 -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You'd like to do it instantaneously, but that's too slow.

1 0

DRM/TCPA/Palladium
by Karl Hiramoto Oct. 22, 2002

Oct. 22, 2002

http://www.cl.cam.ac.uk/users/rja14/tcpa-faq.html Thoughts? Should we boycot? -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Only people with names beginning with 'A' are getting mail this week (a la Microsoft)

4 4

XFree86 SMP Woes
by Marc Hughes Oct. 21, 2002

Oct. 21, 2002

I just installed a second processor, installed an SMP kernel, and booted into it. At first, everything seemed great, I can do massive compiles, top shows both CPU's, and things go pretty zippy. BUT... I can't start X. This is what startx gives me: XFree86 Version 4.2.0 (Red Hat Linux release: 4.2.0-8) / X Window System (protocol Version 11, revision 0, vendor release 6600) Release Date: 23 January 2002 If the server is older than 6-12 months, or if your card is newer than the above date, look for a newer version before reporting problems. (See http://www.XFree86.Org/) Build Operating System: Linux 2.4.17-0.13smp i686 [ELF] Build Host: daffy.perf.redhat.com Module Loader present Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (==) Log file: "/var/log/XFree86.0.log", Time: Mon Oct 21 19:23:34 2002 (==) Using config file: "/etc/X11/XF86Config-4" (EE) RADEON(0): [agp] Could not bind XIO: fatal IO error 104 (Connection reset by peer) on X server ":0.0" after 0 requests (0 known processed) with 0 events remaining. I'm guessing the whole not being able to bind the AGP is the really bad part. I booted into the single CPU kernel, and X still works fine there. Any ideas? -Marc

1 0

sendmail/RH8.0
by Bill Mills-Curran Oct. 21, 2002

Oct. 21, 2002

After upgrading to RedHat 8.0, I'm being forced to learn more about sendmail that I have time to invest, so I need some help. Previously, I had used linuxconf to set up Linux server at work (EMC) that would forward most email to the domain mail server -- I'm not trying to manage mail for the company. One twist... I want to define a few aliases. My linuxconf setup worked great -- I could send email to aliasname(a)thismachine.emc.com, and the /etc/alias file would be used to translate "aliasname" to a list of addresses. With the new split sendmail config, I'm floundering. I've made a few tweaks that were necessary to allow the machine to act as an internal relay (I need some security help here, too), but I'm still fighting a mail loop problem. So, here are my specific questions/requirements: 1. I want to send to an alias on "thismachine.emc.com" from anywhere inside emc. 2. I want the same aliases to be used for email originating from "thismachine". 3. I don't want to create a relay security hole. I'll send my sendmail.mc and submit.mc files upon request. TIA, Bill

1 0

linuxconf replacement?
by Bill Mills-Curran Oct. 21, 2002

Oct. 21, 2002

I've just upgraded to 8.0, and I find that linuxconf is no longer distributed. I was growing fairly fond of it, and I'm wondering what is the latest and greatest system management tool. I've seen "setup", and it's a bit lacking. I like linuxconf because: 1. It doesn't require the detailed (geek-level) knowledge that editing config files requires. 2. It works without a gui, which is very convenient for su-ing to root, or working through slower connections. So, what's the "best" system management tool these days? TIA, Bill

5 6

Re: [Wlug] t-shirts
by Peter Gutowski Oct. 21, 2002

Oct. 21, 2002

>thought the following two would amuse you guys: > >(1) #define QUESTION ((bb) || !(bb)) > There's a lot of truth in that. ;) -- Peter Gutowski <peter(a)linuxchamps.com> // tel.: (413) 531-0123 "When in company, put not your hands to any part of the body not usually discovered." --George Washington, _Rules for Civility and Decent Behavior_

1 0

t-shirts
by doug waud Oct. 21, 2002

Oct. 21, 2002

Hi all I got a catalog from Computergear.com which offered a variety of T-shirts with various incriptions. I thought the following two would amuse you guys: (1) #define QUESTION ((bb) || !(bb)) and (2) The box said "Requires Windows 98 or better" So I installed Linux. doug

1 0