Newsgroup: it.comp.sicurezza.unix
Titolo: [lungo] log di un attacco a postazione

Nella notte tra il 26 ed il 27 ho subito un attacco con relativa perdita di
dati (tutto /etc piu' altre cose)
Non so se abbia fatto altri danni.
Allego i file nel caso vogliate aiutarmi a capire come possa essere
successo.
Da quel che capisco (non capisco molto di log a dire il vero) sembra un
exploit a ftod, ma non mi sembra che era avviato.
/etc/inetd non e' piu' recuperabile.
La directory var e' ancora intatta, a meno di modifiche da parte
dell'attaccante.
Se avete bisogno di altri dati per capire la cosa cerchero' di recuperarli.
La distribuzione era un RH6.2, aggiornata con gli updates vari.
Ciao e grazie
--------
Message.log
Dec 26 22:20:25 red syslogd 1.3-3: restart.
Dec 26 22:20:25 red syslog: syslogd startup succeeded
Dec 26 22:20:25 red syslog: klogd startup succeeded
Dec 26 22:20:25 red kernel: klogd 1.3-3, log source = /proc/kmsg started.
Dec 26 22:20:25 red kernel: Inspecting /boot/System.map-2.2.14-5.0
Dec 26 22:20:25 red kernel: Loaded 7364 symbols from
/boot/System.map-2.2.14-5.0.
Dec 26 22:20:25 red kernel: Symbols match kernel version 2.2.14.
Dec 26 22:20:25 red kernel: Loaded 80 symbols from 7 modules.
Dec 26 22:20:25 red kernel: Linux version 2.2.14-5.0
(
ro...@porky.devel.redhat.com
) (gcc version egcs-2.91.66 19990314/Linux
(egcs-1.1.2 release)) #1 Tue Mar 7 21:07:39 EST 2000
Dec 26 22:20:25 red kernel: relocating initrd image:
Dec 26 22:20:25 red kernel: initrd_start:0xc0f98000 initrd_end:0xc0ffff87
Dec 26 22:20:25 red kernel: mem_start:0xc026c000 mem_end:0xd0000000
Dec 26 22:20:25 red kernel: initrd_size:0x00067f87 dest:0xcff98000
Dec 26 22:20:25 red kernel: Detected 451034341 Hz processor.
Dec 26 22:20:25 red kernel: Console: colour VGA+ 80x25
Dec 26 22:20:25 red kernel: Calibrating delay loop... 450.56 BogoMIPS
Dec 26 22:20:25 red kernel: Memory: 257264k/262144k available (1060k kernel
code, 416k reserved, 2924k data, 64k init, 0k bigmem)
Dec 26 22:20:26 red kernel: Dentry hash table entries: 262144 (order 9,
2048k)
Dec 26 22:20:26 red kernel: Buffer cache hash table entries: 262144 (order
8, 1024k)
Dec 26 22:20:26 red kernel: Page cache hash table entries: 65536 (order 6,
256k)
Dec 26 22:20:26 red kernel: VFS: Diskquotas version dquot_6.4.0 initialized
Dec 26 22:20:26 red kernel: CPU: Intel Pentium II (Deschutes) stepping 02
Dec 26 22:20:26 red kernel: Enabling extended fast FPU save and
restore...done.
Dec 26 22:20:26 red kernel: Checking 386/387 coupling... OK, FPU using
exception 16 error reporting.
Dec 26 22:20:26 red kernel: Checking 'hlt' instruction... OK.
Dec 26 22:20:26 red kernel: POSIX conformance testing by UNIFIX
Dec 26 22:20:26 red kernel: mtrr: v1.35a (19990819) Richard Gooch
(
rgo...@atnf.csiro.au
)
Dec 26 22:20:26 red kernel: PCI: PCI BIOS revision 2.10 entry at 0xfb2b0
Dec 26 22:20:26 red kernel: PCI: Using configuration type 1
Dec 26 22:20:26 red kernel: PCI: Probing PCI hardware
Dec 26 22:20:26 red kernel: Linux NET4.0 for Linux 2.2
Dec 26 22:20:26 red kernel: Based upon Swansea University Computer Society
NET3.039
Dec 26 22:20:26 red kernel: NET4: Unix domain sockets 1.0 for Linux NET4.0.
Dec 26 22:20:26 red kernel: NET4: Linux TCP/IP 1.0 for NET4.0
Dec 26 22:20:26 red kernel: IP Protocols: ICMP, UDP, TCP, IGMP
Dec 26 22:20:26 red kernel: TCP: Hash tables configured (ehash 262144 bhash
65536)
Dec 26 22:20:26 red kernel: Initializing RT netlink socket
Dec 26 22:20:26 red kernel: Starting kswapd v 1.5
Dec 26 22:20:26 red kernel: Detected PS/2 Mouse Port.
Dec 26 22:20:26 red kernel: Serial driver version 4.27 with MANY_PORTS
MULTIPORT SHARE_IRQ enabled
Dec 26 22:20:26 red kernel: ttyS00 at 0x03f8 (irq = 4) is a 16550A
Dec 26 22:20:26 red kernel: ttyS01 at 0x02f8 (irq = 3) is a 16550A
Dec 26 22:20:26 red kernel: pty: 256 Unix98 ptys configured
Dec 26 22:20:26 red kernel: apm: BIOS version 1.2 Flags 0x07 (Driver version
1.9)
Dec 26 22:20:26 red kernel: Real Time Clock Driver v1.09
Dec 26 22:20:26 red kernel: RAM disk driver initialized: 16 RAM disks of
4096K size
Dec 26 22:20:26 red kernel: PIIX4: IDE controller on PCI bus 00 dev 39
Dec 26 22:20:26 red kernel: PIIX4: not 100% native mode: will probe irqs
later
Dec 26 22:20:26 red kernel: ide0: BM-DMA at 0xf000-0xf007, BIOS settings:
hda:pio, hdb:pio
Dec 26 22:20:26 red kernel: ide1: BM-DMA at 0xf008-0xf00f, BIOS settings:
hdc:pio, hdd:pio
Dec 26 22:20:26 red kernel: hda: IBM-DJNA-372200, ATA DISK drive
Dec 26 22:20:26 red kernel: hdc: IBM-DTLA-307030, ATA DISK drive
Dec 26 22:20:26 red kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
Dec 26 22:20:26 red kernel: ide1 at 0x170-0x177,0x376 on irq 15
Dec 26 22:20:26 red kernel: hda: IBM-DJNA-372200, 21557MB w/1966kB Cache,
CHS=10950/64/63
Dec 26 22:20:26 red kernel: hdc: IBM-DTLA-307030, 29314MB w/1916kB Cache,
CHS=59560/16/63
Dec 26 22:20:26 red kernel: Floppy drive(s): fd0 is 1.44M
Dec 26 22:20:26 red kernel: FDC 0 is a post-1991 82077
Dec 26 22:20:26 red kernel: md driver 0.90.0 MAX_MD_DEVS=256, MAX_REAL=12
Dec 26 22:20:26 red kernel: raid5: measuring checksumming speed
Dec 26 22:20:26 red kernel: raid5: MMX detected, trying high-speed MMX
checksum routines
Dec 26 22:20:26 red kernel: pII_mmx : 1048.131 MB/sec
Dec 26 22:20:26 red kernel: p5_mmx : 1112.520 MB/sec
Dec 26 22:20:26 red kernel: 8regs : 775.716 MB/sec
Dec 26 22:20:26 red kernel: 32regs : 441.960 MB/sec
Dec 26 22:20:26 red kernel: using fastest function: p5_mmx (1112.520 MB/sec)
Dec 26 22:20:26 red kernel: scsi : 0 hosts.
Dec 26 22:20:26 red kernel: scsi : detected total.
Dec 26 22:20:26 red kernel: md.c: sizeof(mdp_super_t) = 4096
Dec 26 22:20:26 red kernel: Partition check:
Dec 26 22:20:26 red kernel: hda: hda1 < hda5 hda6 hda7 hda8 hda9 hda10 hda11
hda12 hda13 > hda2 hda3 hda4
Dec 26 22:20:26 red kernel: hdc: [PTBL] [3737/255/63] hdc1
Dec 26 22:20:26 red kernel: RAMDISK: Compressed image found at block 0
Dec 26 22:20:26 red kernel: autodetecting RAID arrays
Dec 26 22:20:26 red kernel: autorun ...
Dec 26 22:20:26 red kernel: ... autorun DONE.
Dec 26 22:20:26 red kernel: EXT2-fs warning: checktime reached, running
e2fsck is recommended
Dec 26 22:20:26 red kernel: VFS: Mounted root (ext2 filesystem).
Dec 26 22:20:26 red kernel: scsi0 : AdvanSys SCSI 3.2M: PCI Ultra 240 CDB:
IO E400/F, IRQ 5
Dec 26 22:20:26 red kernel: scsi : 1 host.
Dec 26 22:20:26 red kernel: Vendor: PLEXTOR Model: CD-ROM PX-32TS Rev: 1.03
Dec 26 22:20:26 red kernel: Type: CD-ROM ANSI SCSI revision: 02
Dec 26 22:20:26 red kernel: Detected scsi CD-ROM sr0 at scsi0, channel 0, id
0, lun 0
Dec 26 22:20:26 red kernel: Uniform CDROM driver Revision: 2.56
Dec 26 22:20:26 red kernel: autodetecting RAID arrays
Dec 26 22:20:26 red kernel: autorun ...
Dec 26 22:20:26 red kernel: ... autorun DONE.
Dec 26 22:20:26 red kernel: VFS: Mounted root (ext2 filesystem) readonly.
Dec 26 22:20:26 red kernel: change_root: old root has d_count=1
Dec 26 22:20:26 red kernel: Trying to unmount old root ... okay
Dec 26 22:20:26 red kernel: Freeing unused kernel memory: 64k freed
Dec 26 22:20:26 red kernel: Adding Swap: 133016k swap-space (priority -1)
Dec 26 22:20:26 red kernel: Adding Swap: 133016k swap-space (priority -2)
Dec 26 22:20:26 red kernel: es1371: version v0.22 time 21:11:16 Mar 7 2000
Dec 26 22:20:26 red kernel: es1371: found chip, vendor id 0x1274 device id
0x1371 revision 0x06
Dec 26 22:20:26 red kernel: es1371: found es1371 rev 6 at io 0xec00 irq 10
Dec 26 22:20:26 red kernel: es1371: features: joystick 0x0
Dec 26 22:20:26 red kernel: es1371: codec vendor TRA (0x545241) revision 35
(0x23)
Dec 26 22:20:26 red kernel: es1371: codec features none
Dec 26 22:20:26 red kernel: es1371: stereo enhancement: no 3D stereo
enhancement
Dec 26 22:20:26 red kernel: EXT2-fs warning: mounting unchecked fs, running
e2fsck is recommended
Dec 26 22:20:26 red kernel: 3c59x.c:v0.99H 11/17/98 Donald Becker
http://cesdis.gsfc.nasa.gov/linux/drivers/vortex.html
Dec 26 22:20:26 red kernel: eth0: 3Com 3c905B Cyclone 100baseTx at 0xe800,
00:10:5a:6e:0a:d5, IRQ 9
Dec 26 22:20:26 red kernel: 8K byte-wide RAM 5:3 Rx:Tx split,
autoselect/Autonegotiate interface.
Dec 26 22:20:26 red kernel: MII transceiver found at address 24, status
7849.
Dec 26 22:20:26 red kernel: MII transceiver found at address 0, status 7849.
Dec 26 22:20:26 red kernel: Enabling bus-master transmits and whole-frame
receives.
Dec 26 22:20:26 red kernel: CSLIP: code copyright 1989 Regents of the
University of California
Dec 26 22:20:26 red kernel: PPP: version 2.3.7 (demand dialling)
Dec 26 22:20:26 red kernel: PPP line discipline registered.
Dec 26 22:20:26 red crond: crond startup succeeded
Dec 26 22:20:26 red inet: inetd startup succeeded
Dec 26 22:20:26 red inetd[416]: extra conf for service linuxconf/tcp
(skipped)
Dec 26 22:20:26 red inetd[416]: extra conf for service linuxconf/tcp
(skipped)
Dec 26 22:20:26 red inetd[416]: gds_db/tcp: unknown service
Dec 26 22:20:26 red routed[430]: Cannot log to routed: not under
/var/log/routed/
Dec 26 22:20:26 red routed: routed startup succeeded
Dec 26 22:20:26 red lpd[444]: restarted
Dec 26 22:20:26 red lpd: lpd startup succeeded
Dec 26 22:20:02 red rc.sysinit: Mounting proc filesystem succeeded
Dec 26 22:20:02 red sysctl: net.ipv4.ip_forward = 0
Dec 26 22:20:02 red sysctl: net.ipv4.conf.all.rp_filter = 1
Dec 26 22:20:02 red sysctl: net.ipv4.ip_always_defrag = 0
Dec 26 22:20:02 red sysctl: kernel.sysrq = 0
Dec 26 22:20:02 red sysctl: net.ipv4.ip_forward = 1
Dec 26 22:20:02 red rc.sysinit: Configuring kernel parameters succeeded
Dec 26 22:20:02 red date: Tue Dec 26 22:19:59 CET 2000
Dec 26 22:20:02 red rc.sysinit: Setting clock : Tue Dec 26 22:19:59 CET 2000
succeeded
Dec 26 22:20:02 red rc.sysinit: Loading default keymap succeeded
Dec 26 22:20:02 red rc.sysinit: Setting default font succeeded
Dec 26 22:20:02 red rc.sysinit: Activating swap partitions succeeded
Dec 26 22:20:02 red rc.sysinit: Setting hostname red.rete.locale succeeded
Dec 26 22:20:02 red fsck: /dev/hda5: clean, 10756/526336 files,
254688/2098593 blocks
Dec 26 22:20:02 red rc.sysinit: Checking root filesystem succeeded
Dec 26 22:20:02 red rc.sysinit: Remounting root filesystem in read-write
mode succeeded
Dec 26 22:20:05 red rc.sysinit: Finding module dependencies succeeded
Dec 26 22:20:05 red rc.sysinit: Loading sound module (es1371) succeeded
Dec 26 22:20:05 red aumix-minimal: vol set to 89, 89, P
Dec 26 22:20:05 red rc.sysinit: Loading mixer settings succeeded
Dec 26 22:20:05 red aumix-minimal: pcm set to 78, 78
Dec 26 22:20:05 red aumix-minimal: speaker set to 64, 64
Dec 26 22:20:05 red aumix-minimal: line set to 64, 64, R
Dec 26 22:20:05 red aumix-minimal: mic set to 66, 66, P
Dec 26 22:20:05 red aumix-minimal: cd set to 79, 79, P
Dec 26 22:20:05 red aumix-minimal: rec set to 64, 64
Dec 26 22:20:05 red aumix-minimal: ogain set to 64, 64
Dec 26 22:20:05 red aumix-minimal: line1 set to 62, 62, P
Dec 26 22:20:05 red aumix-minimal: phin set to 66, 66, P
Dec 26 22:20:05 red aumix-minimal: video set to 64, 64, P
Dec 26 22:20:05 red fsck: /dev/hda3: clean, 54519/526336 files,
1449961/2098656 blocks
Dec 26 22:20:05 red fsck: /dev/hda6: clean, 100219/526336 files,
1809029/2098624 blocks
Dec 26 22:20:05 red fsck: /dev/hda11: clean, 36489/526336 files,
1326836/2098624 blocks
Dec 26 22:20:05 red fsck: /dev/hda2: clean, 41471/526336 files,
1703451/2098656 blocks
Dec 26 22:20:05 red fsck: /dev/hda12: clean, 23350/461216 files,
234355/921808 blocks
Dec 26 22:20:05 red fsck: /dev/hda13: clean, 78719/389376 files,
638178/778168 blocks
Dec 26 22:20:05 red rc.sysinit: Checking filesystems succeeded
Dec 26 22:20:22 red rc.sysinit: Mounting local filesystems succeeded
Dec 26 22:20:22 red rc.sysinit: Turning on user and group quotas for local
filesystems succeeded
Dec 26 22:20:23 red rc.sysinit: Enabling swap space succeeded
Dec 26 22:20:23 red init: Entering runlevel: 3
Dec 26 22:20:24 red sysctl: net.ipv4.ip_forward = 0
Dec 26 22:20:24 red sysctl: net.ipv4.conf.all.rp_filter = 1
Dec 26 22:20:24 red sysctl: net.ipv4.ip_always_defrag = 0
Dec 26 22:20:24 red sysctl: kernel.sysrq = 0
Dec 26 22:20:24 red sysctl: net.ipv4.ip_forward = 1
Dec 26 22:20:24 red network: Setting network parameters succeeded
Dec 26 22:20:24 red network: Bringing up interface lo succeeded
Dec 26 22:20:24 red network: Bringing up interface eth0 succeeded
Dec 26 22:20:25 red autofs: autofs startup succeeded
Dec 26 22:20:25 red automount[352]: starting automounter version 3.1.4, path
= /misc, maptype = file, mapname = /etc/auto.misc
Dec 26 22:20:25 red random: Initializing random number generator succeeded
Dec 26 22:20:26 red keytable: Loading keymap:
Dec 26 22:20:27 red keytable: Loading
/usr/lib/kbd/keymaps/i386/qwerty/it.kmap.gz
Dec 26 22:20:28 red keytable: Loading system font:
Dec 26 22:20:28 red rc: Starting keytable succeeded
Dec 26 22:20:31 red postfix: postfix startup succeeded
Dec 26 22:20:34 red httpd: httpd startup succeeded
Dec 26 22:20:35 red PAM_pwdb[540]: (su) session opened for user postgres by
(uid=0)
Dec 26 22:20:35 red PAM_pwdb[540]: (su) session closed for user postgres
Dec 26 22:20:40 red xfs: xfs startup succeeded
Dec 26 22:20:40 red linuxconf: Linuxconf final setup
Dec 26 22:20:42 red rc: Starting linuxconf succeeded
Dec 26 22:20:47 red PAM_pwdb[711]: (login) session opened for user conraid
by LOGIN(uid=0)
Dec 26 22:21:49 red kernel: registered device ppp0
Dec 26 22:21:49 red pppd[798]: pppd 2.3.11 started by conraid, uid 503
Dec 26 22:21:49 red pppd[798]: Using interface ppp0
Dec 26 22:21:49 red pppd[798]: Connect: ppp0 <--> /dev/ttyS0
Dec 26 22:22:00 red kernel: PPP BSD Compression module registered
Dec 26 22:22:00 red kernel: PPP Deflate Compression module registered
Dec 26 22:22:01 red pppd[798]: local IP address 213.167.202.16
Dec 26 22:22:01 red pppd[798]: remote IP address 212.41.192.47
Dec 26 23:28:09 red modprobe: modprobe: Can't locate module net-pf-10
Dec 27 00:06:10 red ftpd[2770]: FTP session closed
Dec 26 23:10:23 red ftpd[2850]: ANONYMOUS FTP LOGIN FROM
213-167-213-228.flat.galactica.it
 [213.167.213.228],
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞�ﾀ1ﾛ1ﾉｰFﾍ?1ﾀ1ﾛC?ﾙAｰ?ﾍ?�k^1ﾀ1ﾉ洪^A
^F^Dfｹ^Aｰ'ﾍ?1ﾀ洪^Aｰ=ﾍ?1ﾀ1ﾛ洪^H?C^B1ﾉﾉ1ﾀ洪^Hｰ^Lﾍ?ﾉu�ﾀ^F^I洪^Hｰ=ﾍ?^Nｰ0ﾈ^
F^D1ﾀ^F^G?v^H?F^L?N^H昂^Lｰ^Kﾍ?1ﾀ1ﾛｰ^Aﾍ?關0bin0sh1..11
Dec 26 23:10:58 red ftpd[2850]: FTP session closed
Dec 26 23:11:19 red ftpd[2903]: ANONYMOUS FTP LOGIN FROM
213-167-213-228.flat.galactica.it
 [213.167.213.228],
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞1ﾀ
1ﾛ1ﾉｰFﾍ?1ﾀ1ﾛC?ﾙAｰ?ﾍ?�k^1ﾀ1ﾉ洪^A^F^Dfｹ^Aｰ'ﾍ?1ﾀ洪^Aｰ=ﾍ?1ﾀ1ﾛ洪^H?C^B1ﾉﾉ1ﾀ洪^H
ｰ^Lﾍ?ﾉu�ﾀ^F^I洪^Hｰ=ﾍ?^Nｰ0ﾈ^F^D1ﾀ^F^G?v^H?F^L?N^H昂^Lｰ^Kﾍ?1ﾀ1ﾛｰ^Aﾍ?關

0bin0sh1..11venglin@kocham.kasie.com
Dec 26 23:11:48 red ftpd[2903]: FTP session closed
Dec 26 23:11:55 red ftpd[2925]: ANONYMOUS FTP LOGIN FROM
213-167-213-228.flat.galactica.it
 [213.167.213.228],
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞1ﾀ
1ﾛ1ﾉｰFﾍ?1ﾀ1ﾛC?ﾙAｰ?ﾍ?�k^1ﾀ1ﾉ洪^A^F^Dfｹ^Aｰ'ﾍ?1ﾀ洪^Aｰ=ﾍ?1ﾀ1ﾛ洪^H?C^B1ﾉﾉ1ﾀ洪^H
ｰ^Lﾍ?ﾉu�ﾀ^F^I洪^Hｰ=ﾍ?^Nｰ0ﾈ^F^D1ﾀ^F^G?v^H?F^L?N^H昂^Lｰ^Kﾍ?1ﾀ1ﾛｰ^Aﾍ?關

0bin0sh1..11venglin@kocham.kasie.com
Dec 26 23:12:19 red ftpd[2925]: FTP session closed
Dec 26 23:12:24 red ftpd[2953]: ANONYMOUS FTP LOGIN FROM
213-167-213-228.flat.galactica.it
 [213.167.213.228],
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞1ﾀ
1ﾛ1ﾉｰFﾍ?1ﾀ1ﾛC?ﾙAｰ?ﾍ?�k^1ﾀ1ﾉ洪^A^F^Dfｹ^Aｰ'ﾍ?1ﾀ洪^Aｰ=ﾍ?1ﾀ1ﾛ洪^H?C^B1ﾉﾉ1ﾀ洪^H
ｰ^Lﾍ?ﾉu�ﾀ^F^I洪^Hｰ=ﾍ?^Nｰ0ﾈ^F^D1ﾀ^F^G?v^H?F^L?N^H昂^Lｰ^Kﾍ?1ﾀ1ﾛｰ^Aﾍ?關

0bin0sh1..11venglin@kocham.kasie.com
Dec 26 23:12:54 red ftpd[2953]: FTP session closed
Dec 26 23:12:59 red ftpd[2970]: ANONYMOUS FTP LOGIN FROM
213-167-213-228.flat.galactica.it
 [213.167.213.228],
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞
瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞瑞1ﾀ
1ﾛ1ﾉｰFﾍ?1ﾀ1ﾛC?ﾙAｰ?ﾍ?�k^1ﾀ1ﾉ洪^A^F^Dfｹ^Aｰ'ﾍ?1ﾀ洪^Aｰ=ﾍ?1ﾀ1ﾛ洪^H?C^B1ﾉﾉ1ﾀ洪^H
ｰ^Lﾍ?ﾉu�ﾀ^F^I洪^Hｰ=ﾍ?^Nｰ0ﾈ^F^D1ﾀ^F^G?v^H?F^L?N^H昂^Lｰ^Kﾍ?1ﾀ1ﾛｰ^Aﾍ?關

0bin0sh1..11venglin@kocham.kasie.com
Dec 27 00:38:31 red inetd[416]: extra conf for service linuxconf/tcp
(skipped)
Dec 27 00:38:31 red inetd[416]: extra conf for service linuxconf/tcp
(skipped)
Dec 27 00:38:31 red inetd[416]: gds_db/tcp: unknown service
Dec 27 00:38:41 red PAM_pwdb[3523]: check pass; user unknown
Dec 27 00:38:42 red login[3523]: FAILED LOGIN 1 FROM
213-167-213-228.flat.galactica.it
 FOR def+, User not known to the underlying
authentication module
Dec 27 00:38:44 red PAM_pwdb[3523]: authentication failure; (uid=0) -> def
for login service
Dec 27 00:38:45 red login[3523]: FAILED LOGIN 2 FROM
213-167-213-228.flat.galactica.it
 FOR def, Authentication failure
Dec 27 00:38:52 red login[3523]: FAILED LOGIN 3 FROM
213-167-213-228.flat.galactica.it
 FOR def, Authentication failure
Dec 27 00:39:38 red inetd[416]: pid 3522: exit status 1
Dec 27 00:40:04 red PAM_pwdb[3548]: authentication failure; (uid=0) ->
bavoso for login service
Dec 27 00:40:05 red login[3548]: FAILED LOGIN 1 FROM
213-167-213-228.flat.galactica.it
 FOR bavoso, Authentication failure
Dec 27 00:40:08 red PAM_pwdb[3548]: authentication failure; (uid=0) -> def
for login service
Dec 27 00:40:09 red login[3548]: FAILED LOGIN 2 FROM
213-167-213-228.flat.galactica.it
 FOR def, Authentication failure
Dec 27 00:40:13 red login[3548]: FAILED LOGIN 3 FROM
213-167-213-228.flat.galactica.it
 FOR def, Authentication failure
Dec 27 00:41:01 red inetd[416]: pid 3547: exit status 1
Dec 27 00:54:11 red inetd[3824]: getpwnam: root: No such user
Dec 27 00:54:11 red inetd[416]: pid 3824: exit status 1
Dec 27 00:54:25 red inetd[3834]: getpwnam: root: No such user
Dec 27 00:54:25 red inetd[416]: pid 3834: exit status 1
Dec 26 23:54:25 red modprobe: modprobe: Can't locate module net-pf-10
Dec 27 00:54:29 red inetd[3842]: getpwnam: root: No such user
Dec 27 00:54:29 red inetd[416]: pid 3842: exit status 1
Dec 26 23:56:29 red login: PAM _pam_init_handlers: could not open
/etc/pam.conf
Dec 26 23:56:29 red login: PAM pam_start: failed to initialize handlers
Dec 26 23:56:29 red login: Couldn't initialize PAM: Success
Dec 26 23:56:33 red login: PAM _pam_init_handlers: could not open
/etc/pam.conf
Dec 26 23:56:33 red login: PAM pam_start: failed to initialize handlers
Dec 26 23:56:33 red login: Couldn't initialize PAM: Success
Dec 27 00:57:58 red pppd[798]: Terminating on signal 15.
Dec 27 00:57:58 red pppd[798]: Connection terminated.
Dec 27 00:57:58 red pppd[798]: Connect time 156.2 minutes.
Dec 27 00:57:58 red pppd[798]: Sent 1191350 bytes, received 6759359 bytes.
Dec 27 00:57:58 red pppd[798]: Exit.
dic 26 23:58:14 red mc: /dev/gpmctl: Connessione rifiutata
dic 26 23:58:14 red mc: /dev/gpmctl: File o directory inesistente
Dec 26 23:58:24 red login: PAM _pam_init_handlers: could not open
/etc/pam.conf
Dec 26 23:58:24 red login: PAM pam_start: failed to initialize handlers
Dec 26 23:58:24 red login: Couldn't initialize PAM: Success
dic 26 23:58:34 red mc: /dev/gpmctl: Connessione rifiutata
dic 26 23:58:34 red mc: /dev/gpmctl: File o directory inesistente
dic 26 23:59:45 red mc: /dev/gpmctl: Connessione rifiutata
dic 26 23:59:45 red mc: /dev/gpmctl: File o directory inesistente
------
Secure.log
Dec 26 22:20:48 red login: LOGIN ON tty1 BY conraid
Dec 27 00:06:10 red in.ftpd[2770]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:06:10 red in.ftpd[2770]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:06:10 red in.ftpd[2770]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:10:17 red in.ftpd[2850]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:10:17 red in.ftpd[2850]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:10:17 red in.ftpd[2850]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:11:18 red in.ftpd[2903]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:11:18 red in.ftpd[2903]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:11:18 red in.ftpd[2903]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:11:54 red in.ftpd[2925]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:11:54 red in.ftpd[2925]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:11:54 red in.ftpd[2925]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:12:23 red in.ftpd[2953]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:12:23 red in.ftpd[2953]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:12:23 red in.ftpd[2953]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:12:58 red in.ftpd[2970]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:12:58 red in.ftpd[2970]: warning: /etc/hosts.deny, line 8: missing
newline or line too long
Dec 27 00:12:58 red in.ftpd[2970]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:38:36 red in.telnetd[3522]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:38:36 red in.telnetd[3522]: warning: /etc/hosts.deny, line 8:
missing newline or line too long
Dec 27 00:38:36 red in.telnetd[3522]: connect from
213-167-213-228.flat.galactica.it
Dec 27 00:39:59 red in.telnetd[3547]: warning: /etc/hosts.allow, line 6:
missing newline or line too long
Dec 27 00:39:59 red in.telnetd[3547]: warning: /etc/hosts.deny, line 8:
missing newline or line too long
Dec 27 00:39:59 red in.telnetd[3547]: connect from
213-167-213-228.flat.galactica.it

 
213-167-213-228.flat.galactica.it
Chiama i signori di galactica, e minaccia azione legale
se non trovano e sospendono l'utente. 
Loro ti diranno che certamente lo faranno.
Chiedi conferma almeno per email (o con raccomandata w/RR),
in modo da avere qualcosa di scritto da incorniciare :)
Se vuoi fare analisi post-mortem, ti consiglio il coroner
toolkit di Cip&Ciop - Venema&Farmer:
http://www.fish.com/tct/
HTH,
-- 
z...@kill-9.it
 . Geek . And proud of it . 
'Why do you close your eyes?' 'So that the room will be empty.' 


questo lo dici tu. Il kernel e' vecchio, ppp e' vecchio, e sono solo i primi 2
che mi sono passati sott'occhio.
inoltre, c'era bisogno di postare tutta la benedetta (si fa per dire, <G>...)
inizializzazione del sistema? e perche' un rigo si e uno no? bastava dalla
connessione in poi.
Questi sono i rischi che si corrono quando non si fa attenzione a come si usano
le cose: linux e' un'arma, e tu l'hai offerta dalla parte dell'impugnatura a
chiunque ti trovasse! ti attacchi a internet e tieni anonftp, linuxconf e
compagnia in funzione e senza un firewall a filtrarli?
e lo stesso che si fa da win, quando si tengono le porte 137-9 a disposizione.
Non siamo in America, che lasciano il latte e i giornali davanti alla porta e al
mattino li trovano pure! Qui troveresti piscio e carta igienica usata! Che e'
quello che infatti ti ritrovi ora: un sistema violato e' un sistema da piallare
a zero e ripristinare, non c'e' storia, TRUSTNO1, Molder rulez!
-- 
Vuoi configurare velocemente internet, postfix, fetchmail, procmail,
leafnode, firewall, dns, wwwoffle,  junkbuster, mutt, slrn ed altro?
Visita 
http://mrshark.sourceforge.net
 oppure  
http://mrshark.cjb.net
e scarica il "Quick&Easy Configuration Howto",  piu' i files citati.


lo so che ho peccato di ingenuita', e il fatto di usare da piu' di 4 anni
linux ed internet senza problemi mi ha fatto non pensare ad alcuni
rischi....
ma dai log si riesce a capire da cosa sono entrati?
vorrei cercare di capire, in modo che la prossima volta abbia piu' difese
attivate.
Grazie

 attivate.
forse il candidato maggiore e' l'accesso ftp anonimo, comunque
anche linuconf mi pare abbia avuto qualche guaio....
reinstalla tutto 
magari un kernel piu' aggiornato
riconfiguri
(solo servizi necessari...)
man ipchains 
man tripwire
e ti ricolleghi...
qualche oretta insomma...


minkia!:-))
(Mulder e` un merdone, anche mia nonna avrebbe indovinato la sua
password...)
(era meno facilmente indovinabile se ci metteva "SkullyFiga"...:-D)
-- 
    Pardo 
 
www.pardo.cjb.net

attivate.
Comunque se hai redhat basta che fai "ntsysv" e togli via tutti i
servizi, e togli via tutto anche da /etc/inetd.conf ...
Cosi` anche senza un firewall sei bello sicuro.
-- 
    Pardo 
 
www.pardo.cjb.net