lkml.org 
[lkml]   [1998]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: 2.0.33 attacked!
Date
In article <Pine.LNX.3.96.980323131552.814A-100000@localhost>,
Gerhard Mack <gmack@imag.net> wrote:
>I picked this up from a friend who's computer was attacked, the attacker
>would only reveal that this is a big in 2.0.33.

No it's not. Every Unix system has this.

First a lot of connects to rshd:
>Feb 22 15:04:39 nasa in.rshd[447]: connect from 200.231.198.213
>Feb 22 15:04:39 nasa rshd[447]: Connection from 200.231.198.213 on illegal
>port

Then inetd refuses connects to the rshd port. Oh and others too I see,
you are really being bombarded here:

>4:58:31 nasa in.telnetd[286]: refused connect from 200.231.198.213
>4:58:31 nasa in.telnetd[287]: refused connect from 200.231.198.213
>4:58:31 nasa in.telnetd[288]: refused connect from 200.231.198.213
>4:58:31 nasa inetd[63]: telnet/tcp server failing (looping), service
>terminated
>5:04:38 nasa inetd[63]: shell/tcp server failing (looping), service
>terminated
>5:07:35 nasa inetd[63]: auth/tcp server failing (looping), service
>terminated

If you read the manpage of inetd you'll find out that if a service is started
more then 40 times in 60 seconds inetd will stop the service. Modern
versions of inetd should then restart the service after 2 or 5 minutes;
old versions did not do this!

Also in the manpage you'll find how to increase this limit if you are so
inclined.

Mike.
--
Miquel van Smoorenburg | Our vision is to speed up time,
miquels@cistron.nl | eventually eliminating it.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.027 / U:0.680 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site