Administrace komentářů

Zdravim, tak si jednou prohlednu, ktere sit. sokety jsou otevrene a kteri demoni na nich poslouchaji a... je tam divna ip, ktera urcite neni moje:

srot# sockstat -4
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
sshd     sshd      1093    4 tcp4   10.0.0.2:22           10.0.0.9:1147
sshd     sshd      1093    6 udp4   10.0.0.2:1149         212.158.128.2:53
root     sshd      1092    4 tcp4   10.0.0.2:22           10.0.0.9:1147
sshd     sshd      1091    4 tcp4   10.0.0.2:22           10.0.0.9:1146
sshd     sshd      1091    7 udp4   10.0.0.2:1147         212.158.128.2:53
root     sshd      1090    4 tcp4   10.0.0.2:22           10.0.0.9:1146
jirib    sshd      1074    4 tcp4   10.0.0.2:22           10.0.0.9:1145
root     sshd      1055    4 tcp4   10.0.0.2:22           10.0.0.9:1145
www      httpd     1013   16 tcp4   10.0.0.2:80           *:*
...zkraceno...

[Muze te mi kdyztak popsat, o co jde pri takovem spojeni s tou public ip adresou?]

Tak jsem zacal hledat... Jsem ale v tomto uplny newbie, takze, jak?

Mrkl jsem na logy (u me FreeBSD, ale myslim, ze toto je obecny dotaz ohledne bezpecnosti :)

auth.log

v klidu, zadny divny prihlaseni

httpd-error.log

dost podivnych souboru takoveho typu:

[Tue May  4 20:44:50 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/scripts/..%2f../winnt/system32/cmd.exe
[Tue May  4 21:31:37 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/scripts/root.exe
[Tue May  4 21:31:38 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/MSADC/root.exe
[Tue May  4 21:31:41 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/c/winnt/system32/cmd.exe
[Tue May  4 21:31:44 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/d/winnt/system32/cmd.exe
[Tue May  4 21:31:44 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/scripts/..%5c../winnt/system32/cmd.exe
[Tue May  4 21:31:44 2004] [error] [client 212.158.251.178] File does not exist: \
/usr/local/www/data/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe 

ipflog

log pro ipfilter (fw)

04/05/2004 19:26:01.867091 rl0 @200:5 b 204.1.226.228,45165 \
-> 10.0.0.2,22 PR tcp len 20 40 -S IN

ipflog.today

0 @1 block out from 127.0.0.0/8 to any group 100
0 @2 block out from any to 127.0.0.0/8 group 100
0 @3 block out from any to 10.0.0.2/32 group 100
0 @1 block in log quick from any to any with ipopt
0 @2 block in log quick proto tcp from any to any with short
185 @4 block in on rl0 from any to any head 200
0 @1 block in from 127.0.0.0/8 to any group 200
0 @2 block in from 10.0.0.2/32 to any group 200
1 @5 block return-rst in log proto tcp from any to any flags S/SA group 200
141 @6 block return-icmp in proto udp from any to any group 200

No...

sockstat

vypis se je az po rebootu, myslim, ze tam predtim byl i sendmail, ackoli byl nastaven, aby se nespoustel VUBEC v /etc/rc.conf - sendmail_enable="NONE" (ale ruku do ohne bych za to nedal... jsem mel ted vystup ulozit).

Jinak

ps aux

nic divnyho, vse normal.

Stalo se teda neco? Existuje nejake podezreni na prunik?

Predem diky za tipy, poznatky, linky na cteni atd. (Tistenou publikaci o hackingu hodlam brzo zakoupit :)

jirib