Newsgroup: it.comp.sicurezza.unix
Titolo: Red Hat 5.0. Violato

Buongiorno a tutti,
	avrei un favore da chiedervi, se vi e' possibile. Sto usando una Redhat
5.0, e qualcuno si diverte ad introdursi nel mio server durante la notte.
Vi metto qui sotto i files /var/log/secure e /var/log/messages.
Le intrusioni sono avvenute alle 1.00 2.00 e 5.00
C'e' qualcuno che mi puo' aiutare a capire come fermare questa dannata
persona, che non conosco, e certamente lui non conosce me?
Probabilmente a quel poco che ho capito sfrutta un bag nella RH, oppure fa
qualcosa d'altro di cui non ho idea.
Per favore aiutatemi, o ditemi cosa fare. Pensavo di montare un firewall,
lo sto facendo, intanto vi prego di dare un'occhiata a questi files, se
c'e' bisogno di vederne altri, basta che me lo diciate.
Vi ringrazio infinitamente.
Un Sysadmin Disperato.
Leopoldo Tomasatti.
Allego in attachment messages e secure
Dec 21 19:40:47 dns kernel: 3c509.c:1.12 6/4/97
bec...@cesdis.gsfc.nasa.gov
Dec 21 19:40:47 dns kernel: eth0: Setting Rx
mode to 1 addresses.
Dec 21 19:40:48 dns named[240]: starting.  named
4.9.6-REL Thu Nov  6 23:29:57 EST 1997
^Ir...@porky.redhat.com:/usr/src/bs/BUILD/bind-4.9.6/named
Dec 21 19:40:49
dns named[240]: cache zone "" loaded (serial 0)
Dec 21 19:40:49 dns
named[240]: primary zone "
netside.it
" loaded (serial 1998120208)
Dec 21
19:40:49 dns named[240]: primary zone "140.210.212.IN-ADDR.ARPA" loaded
(serial 1998120208)
Dec 21 19:40:49 dns named[240]: primary zone
"0.0.127.IN-ADDR.ARPA" loaded (serial 1998120208)
Dec 21 19:40:49 dns
named[241]: Ready to answer queries. 
Dec 21 19:40:52 dns PAM_pwdb[323]:
(su) session opened for user postgres by (uid=100)
Dec 21 19:40:53 dns
PAM_pwdb[323]: (su) session closed for user postgres
Dec 21 19:41:02 dns
PAM_pwdb[373]: (login) session opened for user root by (uid=0)
Dec 21
19:41:02 dns PAM_pwdb[373]: ROOT LOGIN ON tty1
Dec 21 19:41:25 dns
PAM_pwdb[373]: (login) session closed for user root
Dec 21 20:01:00 dns
PAM_pwdb[399]: (su) session opened for user news by (uid=9)
Dec 21 20:01:01
dns PAM_pwdb[399]: (su) session closed for user news
Dec 21 21:01:00 dns
PAM_pwdb[434]: (su) session opened for user news by (uid=9)
Dec 21 21:01:01
dns PAM_pwdb[434]: (su) session closed for user news
Dec 21 22:01:00 dns
PAM_pwdb[469]: (su) session opened for user news by (uid=9)
Dec 21 22:01:01
dns PAM_pwdb[469]: (su) session closed for user news
Dec 21 23:01:00 dns
PAM_pwdb[504]: (su) session opened for user news by (uid=9)
Dec 21 23:01:00
dns PAM_pwdb[504]: (su) session closed for user news
Dec 21 23:24:44 dns
named[241]: ns_resp: query(
network.lu
) contains our address
(dns.netside.it:212.210.140.7)
Dec 21 23:24:44 dns named[241]: ns_resp:
query(
network.lu
) forwarding loop (dns2.interbusiness.it:151.99.125.3)
Dec
21 23:24:44 dns named[241]: ns_resp: query(
network.lu
) No possible A
RRs
Dec 22 00:01:00 dns PAM_pwdb[539]: (su) session opened for user news by
(uid=9)
Dec 22 00:01:00 dns PAM_pwdb[539]: (su) session closed for user
news
Dec 22 01:01:00 dns PAM_pwdb[574]: (su) session opened for user news
by (uid=9)
Dec 22 01:01:00 dns PAM_pwdb[574]: (su) session closed for user
news
Dec 22 01:02:00 dns PAM_pwdb[608]: (su) session opened for user news
by (uid=9)
Dec 22 01:02:32 dns rnews[752]: rejected connection What
server?
Dec 22 01:02:32 dns PAM_pwdb[608]: (su) session closed for user
news
Dec 22 01:02:32 dns rnews[754]: rejected connection What server?
Dec
22 01:02:33 dns PAM_pwdb[768]: (su) session opened for user nobody by
(uid=99)
Dec 22 01:03:36 dns PAM_pwdb[768]: (su) session closed for user
nobody
Dec 22 01:03:58 dns telnetd[809]: ttloop:  peer died: Invalid or
incomplete multibyte or wide character 
Dec 22 02:01:00 dns PAM_pwdb[819]:
(su) session opened for user news by (uid=9)
Dec 22 02:01:01 dns
PAM_pwdb[819]: (su) session closed for user news
Dec 22 02:24:28 dns
telnetd[851]: ttloop:  peer died: Invalid or incomplete multibyte or wide
character 
Dec 22 02:31:22 dns kernel: Swansea University Computer Society
IPX 0.34 for NET3.035
Dec 22 02:31:22 dns kernel: IPX Portions Copyright
(c) 1995 Caldera, Inc.
Dec 22 02:31:22 dns kernel: Appletalk 0.17 for Linux
NET3.035
Dec 22 02:34:11 dns kernel: Swansea University Computer Society
IPX 0.34 for NET3.035
Dec 22 02:34:11 dns kernel: IPX Portions Copyright
(c) 1995 Caldera, Inc.
Dec 22 02:34:11 dns kernel: Appletalk 0.17 for Linux
NET3.035
Dec 22 02:34:30 dns PAM_pwdb[891]: (login) session opened for user
ok by (uid=0)
Dec 22 02:34:30 dns PAM_pwdb[891]: LOGIN ON ttyp0 BY ok FROM
bay-130-b3.codetel.net.do
Dec 22 02:34:33 dns PAM_pwdb[903]: (su) session
opened for user ok1 by ok(uid=0)
Dec 22 02:35:18 dns PAM_pwdb[903]: (su)
session closed for user ok1
Dec 22 02:35:23 dns PAM_pwdb[918]: (login)
session opened for user ok by (uid=0)
Dec 22 02:35:23 dns PAM_pwdb[918]:
LOGIN ON ttyp0 BY ok FROM 
bay-130-b3.codetel.net.do
Dec 22 02:35:26 dns
PAM_pwdb[930]: (su) session opened for user ok1 by ok(uid=0)
Dec 22
02:35:32 dns identd[943]: from: 206.105.235.130 ( 
bay-130-b3.codetel.net.do
) for: 1025, 21
Dec 22 02:35:32 dns identd[943]: Successful lookup: 1025 ,
21 : root.root 
Dec 22 02:44:26 dns PAM_pwdb[930]: (su) session closed for
user ok1
Dec 22 03:01:00 dns PAM_pwdb[1051]: (su) session opened for user
news by (uid=9)
Dec 22 03:01:01 dns PAM_pwdb[1051]: (su) session closed for
user news
Dec 22 04:01:00 dns PAM_pwdb[1086]: (su) session opened for user
news by (uid=9)
Dec 22 04:01:01 dns PAM_pwdb[1086]: (su) session closed for
user news
Dec 22 05:01:00 dns PAM_pwdb[1121]: (su) session opened for user
news by (uid=9)
Dec 22 05:01:00 dns PAM_pwdb[1121]: (su) session closed for
user news
Dec 22 05:46:29 dns telnetd[1153]: ttloop:  peer died: Invalid or
incomplete multibyte or wide character 
Dec 22 05:47:29 dns telnetd[1157]:
ttloop:  peer died: Invalid or incomplete multibyte or wide character 
Dec
22 05:50:33 dns telnetd[1161]: ttloop:  peer died: Invalid or incomplete
multibyte or wide character 
Dec 22 05:52:13 dns telnetd[1165]: ttloop:
peer died: Invalid or incomplete multibyte or wide character 
Dec 22
05:52:39 dns telnetd[1169]: ttloop:  peer died: Invalid or incomplete
multibyte or wide character 
Dec 22 05:52:51 dns telnetd[1173]: ttloop:
peer died: Invalid or incomplete multibyte or wide character 
Dec 22
06:01:00 dns PAM_pwdb[1180]: (su) session opened for user news by
(uid=9)
Dec 22 06:01:00 dns PAM_pwdb[1180]: (su) session closed for user
news
Dec 22 07:01:00 dns PAM_pwdb[1215]: (su) session opened for user news
by (uid=9)
Dec 22 07:01:00 dns PAM_pwdb[1215]: (su) session closed for user
news
Dec 22 08:01:00 dns PAM_pwdb[1250]: (su) session opened for user news
by (uid=9)
Dec 22 08:01:00 dns PAM_pwdb[1250]: (su) session closed for user
news
Dec 22 09:01:00 dns PAM_pwdb[1285]: (su) session opened for user news
by (uid=9)
Dec 22 09:01:00 dns PAM_pwdb[1285]: (su) session closed for user
news
Dec 22 09:48:37 dns login: 2 LOGIN FAILURES ON tty3, root
Dec 22
09:48:44 dns login: ROOT LOGIN ON tty3
Dec 22 09:57:38 dns login: LOGIN
root REFUSED FROM 212.210.140.6 ON TTY ttyp0
Dec 22 09:57:42 dns login:
LOGIN root REFUSED FROM 212.210.140.6 ON TTY ttyp0
Dec 22 09:57:56 dns
login: 2 LOGIN FAILURES FROM 212.210.140.6, ok
Dec 22 09:57:58 dns login: 3
LOGIN FAILURES FROM 212.210.140.6, ok
Dec 22 09:58:00 dns login: 4 LOGIN
FAILURES FROM 212.210.140.6, ok
Dec 22 09:58:07 dns login: 5 LOGIN FAILURES
FROM 212.210.140.6, news
Dec 22 09:58:19 dns login: 6 LOGIN FAILURES FROM
212.210.140.6, news
Dec 22 09:58:33 dns login: LOGIN root REFUSED FROM
212.210.140.6 ON TTY ttyp0
Dec 22 09:58:48 dns login: 2 LOGIN FAILURES FROM
212.210.140.6, news
Dec 22 09:58:51 dns login: 3 LOGIN FAILURES FROM
212.210.140.6, news
Dec 22 10:01:00 dns PAM_pwdb[1359]: (su) session opened
for user news by (uid=9)
Dec 22 10:01:00 dns PAM_pwdb[1359]: (su) session
closed for user news
Dec 22 10:07:07 dns identd[1419]: from: 157.138.15.56
( 
pluto.dma.unive.it
 ) for: 1116, 23
Dec 22 10:07:07 dns identd[1419]:
Successful lookup: 1116 , 23 : root.root 
Dec 22 10:08:19 dns login: 2
LOGIN FAILURES ON tty1,  root
Dec 22 10:08:23 dns login: ROOT LOGIN ON
tty1
Dec 22 10:13:19 dns kernel: hdc : tray open or drive not ready
Dec 22
10:13:20 dns kernel: hdc: media changed
Dec 22 10:26:50 dns login: 2 LOGIN
FAILURES ON tty2, root
Dec 22 10:26:54 dns login: 3 LOGIN FAILURES ON tty2,
root
Dec 22 10:27:00 dns login: ROOT LOGIN ON tty2
Dec 22 09:59:38 dns
ftpd[1506]: ANONYMOUS FTP LOGIN FROM 212.210.140.6 [212.210.140.6],
a...@abc.com
Dec 22 11:00:27 dns login: 2 LOGIN FAILURES ON tty1, root
Dec
22 11:00:31 dns login: ROOT LOGIN ON tty1
Dec 22 11:00:46 dns
PAM_pwdb[1526]: password for (root/0) changed by ((null)/0)
Dec 21 18:18:03 dns in.telnetd[408]: connect from 212.210.140.6
Dec 21
18:18:07 dns login: FAILED LOGIN 1 FROM 212.210.140.6 FOR root,
Authentication failure
Dec 21 18:18:12 dns login: FAILED LOGIN 2 FROM
212.210.140.6 FOR root, Authentication failure
Dec 21 18:18:16 dns login:
FAILED LOGIN 3 FROM 212.210.140.6 FOR root, Authentication failure
Dec 21
18:21:51 dns in.ftpd[413]: connect from 212.210.140.6
Dec 21 18:46:28 dns
login: FAILED LOGIN 1 FROM (null) FOR root, Authentication failure
Dec 21
18:55:13 dns login: FAILED LOGIN 1 FROM (null) FOR root, Authentication
failure
Dec 21 18:55:35 dns in.ftpd[415]: connect from 212.210.140.6
Dec 21
19:36:16 dns login: FAILED LOGIN 1 FROM (null) FOR root, Authentication
failure
Dec 22 01:03:52 dns in.fingerd[808]: connect from
206.105.235.244
Dec 22 01:03:53 dns in.telnetd[809]: connect from
206.105.235.244
Dec 22 01:03:53 dns imapd[810]: connect from
206.105.235.244
Dec 22 01:03:54 dns ipop3d[811]: connect from
206.105.235.244
Dec 22 01:03:58 dns in.telnetd[812]: connect from
206.105.235.244
Dec 22 01:05:09 dns imapd[814]: connect from
206.105.235.244
Dec 22 02:24:27 dns in.fingerd[850]: connect from
206.105.235.130
Dec 22 02:24:28 dns in.telnetd[851]: connect from
206.105.235.130
Dec 22 02:24:31 dns imapd[852]: connect from
206.105.235.130
Dec 22 02:24:32 dns ipop3d[853]: connect from
206.105.235.130
Dec 22 02:24:33 dns in.telnetd[854]: connect from
206.105.235.130
Dec 22 02:25:18 dns imapd[856]: connect from
206.105.235.130
Dec 22 02:27:51 dns imapd[857]: connect from
206.105.235.130
Dec 22 02:34:26 dns in.telnetd[890]: connect from
206.105.235.130
Dec 22 02:35:20 dns in.telnetd[917]: connect from
206.105.235.130
Dec 22 02:44:16 dns in.telnetd[988]: connect from
206.105.235.130
Dec 22 02:59:08 dns in.telnetd[1033]: connect from
206.105.235.221
Dec 22 05:46:29 dns in.telnetd[1153]: connect from
206.105.235.9
Dec 22 05:46:31 dns ipop3d[1154]: connect from
206.105.235.9
Dec 22 05:46:32 dns in.telnetd[1155]: connect from
206.105.235.9
Dec 22 05:47:29 dns in.telnetd[1157]: connect from
206.105.235.9
Dec 22 05:47:30 dns ipop3d[1158]: connect from
206.105.235.9
Dec 22 05:47:31 dns in.telnetd[1159]: connect from
206.105.235.9
Dec 22 05:50:33 dns in.telnetd[1161]: connect from
206.105.235.9
Dec 22 05:50:34 dns ipop3d[1162]: connect from
206.105.235.9
Dec 22 05:50:35 dns in.telnetd[1163]: connect from
206.105.235.9
Dec 22 05:52:13 dns in.telnetd[1165]: connect from
206.105.235.9
Dec 22 05:52:15 dns ipop3d[1166]: connect from
206.105.235.9
Dec 22 05:52:16 dns in.telnetd[1167]: connect from
206.105.235.9
Dec 22 05:52:39 dns in.telnetd[1169]: connect from
206.105.235.9
Dec 22 05:52:40 dns ipop3d[1170]: connect from
206.105.235.9
Dec 22 05:52:41 dns in.telnetd[1171]: connect from
206.105.235.9
Dec 22 05:52:51 dns in.telnetd[1173]: connect from
206.105.235.9
Dec 22 05:52:52 dns ipop3d[1174]: connect from
206.105.235.9
Dec 22 05:52:53 dns in.telnetd[1175]: connect from
206.105.235.9
Dec 22 09:57:37 dns in.telnetd[1338]: connect from
212.210.140.6
Dec 22 09:58:30 dns in.telnetd[1340]: connect from
212.210.140.6
Dec 22 10:59:35 dns in.ftpd[1506]: connect from 212.210.140.6
The Nowhere Man
now...@iol.it
http://users.iol.it/nowhere
--
Posted from 
mta2.iol.it
 [195.210.91.152]
via Mailgate.ORG Server - 
http://www.mailgate.org

 <---
    ---> CA - Honda Transalp '98 <--- ---> Linux RH 5.1 - kernel 2.0.35 <---

 Mailgate.ORG is maintained online by Dario Centofanti
Salve.
Un'altra cosa che puo' essere MOLTO comoda e MOLTO semplice da realizzare e'
chiudere l'accesso root da terminali che non siano la console, in modo che chi
telnetta
possa scrivere tranquillo login & password, ricevere un bell Login Incorrect
ed essere loggato :P
Il file da editare e' /etc/securetty.
Dentro basta cancellare tutte le linee con ttyp e ttyq (quindi ttyp0,
ttyp1,etc....)
e lasciare solo tty1-2-3-4-5-6-7-8
Salvato il file, e fatto un killall -HUP inetd, il povero ''bambinetto'' e'
decisamente fori
dal vostro sistema... a meno che non venga direttamenta a casa vostra dalla
norvegia :P
                                                            Alessio "NaiL^d0d"
Orlandi
--
Posted from 
mta02-acc.tin.it
 [212.216.176.33]


in.fingerd: 127.0.0.1
Questo e'OK

 determinato servizio ,ottenga un determinato messaggio?
per twist man hosts_options, per il resto puoi sempre organizzarti
con qualche script o pacchetto che puoi trovare in rete.


          
Non sono tanto sicuro (dato che mi occupo di queste cose da poco) che
questo basti a tenerlo lontano in norvegia.
Infatti a meno che root non sia l'unico utente (cosa poco consigliabile)
uno puo sempre collegarsi in remoto con un altro utente e fare su dopo
di che diventa root e cambia poco (se non il fatto che si deve trovare
le password di due 
utenti e non di uno, ma se e' capace di beccarti quella di root non
credo ce trovarne un'altra gli debba costare tanta fatica).
Mi piacerebbe semmai sapere come fare a restringere un po' di piu'
l'accesso senza pero' compromettere la possibilita' di diventare root in
remoto (se no' sai che palle tutte le volte che devi fare una modifica
di una macchina che sta in un'altra sede!)
Ciao
Simone