Newsgroup: it.comp.os.linux.sys
Titolo: [lamer] vorrei dei pareri su questo spezzone di log

Ho subito una noia, vorrei delle opinioni piu' obiettive della mia visto
che ora sono entrato in paranoia e, partendo dai banali script-shell
fino ad arrivare alle collezioni di exploit piu' sconosciute, ho
iniziato a girare per la rete mondiale (anche in siti giapponesi, giusto
per capirci) alla ricerca di un cavolo di giocattolino che abbia
permesso al primo lamerozzo di turno di disturbarmi.
Posto solo lo spezzone di oggi, filtrando le centinaia di root
consecutivi, ce ne sono per gli ultimi 5 giorni per 24 ore.
Quale software da lamer ha generato sto casino? se il firewall e'
impostato per filtrare qualunque tentativo di connessione dall'IP
210.101.185.252 gia' da 4 giorni, come e' possibile che siano arrivati
anche solo i pacchetti SYN al mio serverino?
Grazie a tutti
EmJey
da secure.log:
Nov 16 04:41:22 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 04:41:47 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 04:41:47 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 04:42:26 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:05:58 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:05:58 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:06:11 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user www for right system.login.tty.
Nov 16 05:06:11 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:06:22 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:06:22 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:09:27 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 05:09:27 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:03 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:10:03 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:07 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:10:07 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:16 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user nobody for right system.login.tty.
Nov 16 05:10:16 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:21 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user nobody for right system.login.tty.
Nov 16 05:10:21 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:28 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 16 05:10:28 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:33 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 16 05:10:33 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:28 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:28 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:32 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:32 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:37 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:37 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:41 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:41 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:12:03 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:12:03 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:13:10 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:15:04 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user daemon for right system.login.tty.
Nov 16 05:15:04 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:15:31 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user lp for right system.login.tty.
Nov 16 05:15:31 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:25:52 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user sshd for right system.login.tty.
Nov 16 05:25:52 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:36:24 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 05:36:24 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:37:14 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user smmsp for right system.login.tty.
Nov 16 05:37:14 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:35 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user appserver for right system.login.tty.
Nov 16 23:36:35 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:39 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 23:36:39 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:45 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user qtss for right system.login.tty.
Nov 16 23:36:45 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:48 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user eppc for right system.login.tty.
Nov 16 23:36:48 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 17 20:58:49 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 17 20:58:49 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
da system.log:
Nov 21 03:15:03 $nomeComputer syslogd: restart
Nov 21 05:38:35 $nomeComputer xinetd[319]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Nov 21 05:38:35 $nomeComputer xinetd[319]: START: ssh pid=10666
from=210.101.185.252
Nov 21 05:38:35 $nomeComputer sshd[10666]: Did not receive
identification string from 210.101.185.252
Nov 21 06:32:18 $nomeComputer xinetd[319]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Nov 21 06:32:18 $nomeComputer xinetd[319]: START: ssh pid=10678
from=210.101.185.252
Nov 21 06:32:21 $nomeComputer sshd[10678]: Illegal user staff from
210.101.185.252
-- 
Non prendere la vita troppo sul serio... non ne uscirai mai vivo
http://www.joram.it/servizi/consulente.htm

 di default. Cosa c'e' che ti manda in paranoia?
Che prima di questo computer c'e' un firewall CISCO PIX 515E configurato
per bloccare qualunque traffico proveniente dall'IP 210.101.185.252 ma
questo cavolo di script riesce a superarlo in qualche modo. Il firewall
e' aggiornato all'ultima rev ed ho ricontrollato la configurazione 100
volte.
(Maledico di non poter avere un log delle connessioni autorizzate, da
qui la paranoia)
EmJey


 EmJey
Ma perche sulla linux box non fai un banale
route add -host 210.101.185.252 reject ???
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
Perche' mai dovrei desiderare di essere Flaubert quando ho la fortuna di
essere Aldo Busi?
		-- Aldo Busi

 route add -host 210.101.185.252 reject ???
E' un'ottima idea togliere il firewall e mettere una linuxbox in
sostituzione per vedere che cosa passa: in mattinata lo faccio e mi
tolgo il pensiero :-) Grazie della dritta! (e non so come ho fatto a non
pensarci prima! :-P)


 Evidentemente e' configurato male il firewall.
L'ho pensato pure io e l'ho ricontrollata 100 volte, per questo sono
sicuro che non e' la' il problema: te l'ho detto che sono diventato
paranoico :-P
