Re: 2.0.33 attacked!

Miquel van Smoorenburg (miquels@cistron.nl)
23 Mar 1998 23:14:40 +0100


In article <Pine.LNX.3.96.980323131552.814A-100000@localhost>,
Gerhard Mack <gmack@imag.net> wrote:
>I picked this up from a friend who's computer was attacked, the attacker
>would only reveal that this is a big in 2.0.33.

No it's not. Every Unix system has this.

First a lot of connects to rshd:
>Feb 22 15:04:39 nasa in.rshd[447]: connect from 200.231.198.213
>Feb 22 15:04:39 nasa rshd[447]: Connection from 200.231.198.213 on illegal
>port

Then inetd refuses connects to the rshd port. Oh and others too I see,
you are really being bombarded here:

>4:58:31 nasa in.telnetd[286]: refused connect from 200.231.198.213
>4:58:31 nasa in.telnetd[287]: refused connect from 200.231.198.213
>4:58:31 nasa in.telnetd[288]: refused connect from 200.231.198.213
>4:58:31 nasa inetd[63]: telnet/tcp server failing (looping), service
>terminated
>5:04:38 nasa inetd[63]: shell/tcp server failing (looping), service
>terminated
>5:07:35 nasa inetd[63]: auth/tcp server failing (looping), service
>terminated

If you read the manpage of inetd you'll find out that if a service is started
more then 40 times in 60 seconds inetd will stop the service. Modern
versions of inetd should then restart the service after 2 or 5 minutes;
old versions did not do this!

Also in the manpage you'll find how to increase this limit if you are so
inclined.

Mike.

-- 
 Miquel van Smoorenburg | Our vision is to speed up time,
    miquels@cistron.nl  |   eventually eliminating it.

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu