Newsgroup: it.comp.sicurezza.unix
Titolo: [lamer] vorrei dei pareri su questo spezzone di log

Ho subito una noia, vorrei delle opinioni piu' obiettive della mia visto
che ora sono entrato in paranoia e, partendo dai banali script-shell
fino ad arrivare alle collezioni di exploit piu' sconosciute, ho
iniziato a girare per la rete mondiale (anche in siti giapponesi, giusto
per capirci) alla ricerca di un cavolo di giocattolino che abbia
permesso al primo lamerozzo di turno di disturbarmi.
Posto solo lo spezzone di oggi, filtrando le centinaia di root
consecutivi, ce ne sono per gli ultimi 5 giorni per 24 ore.
Quale software da lamer ha generato sto casino? se il firewall e'
impostato per filtrare qualunque tentativo di connessione dall'IP
210.101.185.252 gia' da 4 giorni, come e' possibile che siano arrivati
anche solo i pacchetti SYN al mio serverino?
Grazie a tutti
EmJey
da secure.log:
Nov 16 04:41:22 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 04:41:47 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 04:41:47 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 04:42:26 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:05:58 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:05:58 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:06:11 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user www for right system.login.tty.
Nov 16 05:06:11 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:06:22 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:06:22 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:09:27 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 05:09:27 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:03 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:10:03 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:07 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 05:10:07 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:16 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user nobody for right system.login.tty.
Nov 16 05:10:16 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:21 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user nobody for right system.login.tty.
Nov 16 05:10:21 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:28 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 16 05:10:28 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:10:33 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 16 05:10:33 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:28 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:28 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:32 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:32 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:37 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:37 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:11:41 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user cyrus for right system.login.tty.
Nov 16 05:11:41 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:12:03 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:12:03 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:13:10 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user root for right system.login.tty.
Nov 16 05:15:04 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user daemon for right system.login.tty.
Nov 16 05:15:04 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:15:31 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user lp for right system.login.tty.
Nov 16 05:15:31 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:25:52 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user sshd for right system.login.tty.
Nov 16 05:25:52 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:36:24 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mysql for right system.login.tty.
Nov 16 05:36:24 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 05:37:14 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user smmsp for right system.login.tty.
Nov 16 05:37:14 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:35 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user appserver for right system.login.tty.
Nov 16 23:36:35 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:39 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user mailman for right system.login.tty.
Nov 16 23:36:39 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:45 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user qtss for right system.login.tty.
Nov 16 23:36:45 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 16 23:36:48 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user eppc for right system.login.tty.
Nov 16 23:36:48 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
Nov 17 20:58:49 $nomeComputer com.apple.SecurityServer: authinternal
failed to authenticate user postfix for right system.login.tty.
Nov 17 20:58:49 $nomeComputer com.apple.SecurityServer: Failed to
authorize right system.login.tty by process /usr/sbin/xinetd for
authorization created by /usr/sbin/xinetd.
da system.log:
Nov 21 03:15:03 $nomeComputer syslogd: restart
Nov 21 05:38:35 $nomeComputer xinetd[319]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Nov 21 05:38:35 $nomeComputer xinetd[319]: START: ssh pid=10666
from=210.101.185.252
Nov 21 05:38:35 $nomeComputer sshd[10666]: Did not receive
identification string from 210.101.185.252
Nov 21 06:32:18 $nomeComputer xinetd[319]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Nov 21 06:32:18 $nomeComputer xinetd[319]: START: ssh pid=10678
from=210.101.185.252
Nov 21 06:32:21 $nomeComputer sshd[10678]: Illegal user staff from
210.101.185.252
-- 
Non prendere la vita troppo sul serio... non ne uscirai mai vivo
http://www.joram.it/servizi/consulente.htm

 210.101.185.252
A non saper ne' leggere ne' scrivere, sei sotto "attacco".
 - ∞



Questo l'avevo intuito pure io ;-) il problema e' che apparentemente il
firewall tra il router ed il server non mi salva da questo attacco
nonostante sia settato _appositamente_ per bloccare qualunque traffico
proveniente da $ipBastardo (ossia 210.101.185.252) quindi vorrei capire
se stanno usando un software particolare e come prevenire ulteriori noie
EmJey


 setsockopt() failed: Protocol not available (errno = 42)
worm ssh.
Ma davvero macosx lancia ssh sotto xinetd?

 Ma davvero macosx lancia ssh sotto xinetd?
Si, se non configuri diversamente, perche'?
Figurati che io ho preso l'abitudine di farlo anche sotto openbsd :-P
EmJey
