Messages in this thread | | | From | (Miquel van Smoorenburg) | Subject | Re: 2.0.33 attacked! | Date | 23 Mar 1998 23:14:40 +0100 |
| |
In article <Pine.LNX.3.96.980323131552.814A-100000@localhost>, Gerhard Mack <gmack@imag.net> wrote: >I picked this up from a friend who's computer was attacked, the attacker >would only reveal that this is a big in 2.0.33.
No it's not. Every Unix system has this.
First a lot of connects to rshd: >Feb 22 15:04:39 nasa in.rshd[447]: connect from 200.231.198.213 >Feb 22 15:04:39 nasa rshd[447]: Connection from 200.231.198.213 on illegal >port
Then inetd refuses connects to the rshd port. Oh and others too I see, you are really being bombarded here:
>4:58:31 nasa in.telnetd[286]: refused connect from 200.231.198.213 >4:58:31 nasa in.telnetd[287]: refused connect from 200.231.198.213 >4:58:31 nasa in.telnetd[288]: refused connect from 200.231.198.213 >4:58:31 nasa inetd[63]: telnet/tcp server failing (looping), service >terminated >5:04:38 nasa inetd[63]: shell/tcp server failing (looping), service >terminated >5:07:35 nasa inetd[63]: auth/tcp server failing (looping), service >terminated
If you read the manpage of inetd you'll find out that if a service is started more then 40 times in 60 seconds inetd will stop the service. Modern versions of inetd should then restart the service after 2 or 5 minutes; old versions did not do this!
Also in the manpage you'll find how to increase this limit if you are so inclined.
Mike. -- Miquel van Smoorenburg | Our vision is to speed up time, miquels@cistron.nl | eventually eliminating it.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |