🚀 go-pugleaf

Graham Daniell wrote:
> 
> I have a RH 6.2 Linux server (torvalds) which provides internet
> connection for my home network of several Win9x PC's and one RH72
> PC.
> 
> For some time I have been getting attacked by this IP number:
> 
> May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
> 195.119.1.180
> May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
> 195.119.1.180
> May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
> 195.119.1.180
> May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
> 195.119.1.180

Seems that your server is refusing connections ok.  This in itself is
not a major problem ... what is of concern, is that you have a telnet
daemon listening on the net for connections in the first place.  This
leads me to the conclusion that you are probably not running a firewall
of any description, and that the crackers may find other entry points
like ftp, smtp etc. ... this needs to be addressed quickly and properly.

> Last night's message log showed this:
> 
> May 26 20:49:41 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> May 26 20:49:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
> May 26 20:55:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
> May 26 20:56:00 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded
> 
> It looks to me like someone managed to install a route between my
> internal network and an unknown address (probably 195.119.1.180?)

Hard to say again, this could indicate a misconfigured daemon???

Have a look in your /etc/passwd and /etc/shadow files for "new" user
accounts or even system accounts with root privileges.

check the creation dates for programs like netstat ps top find ls and
see if they differ wildly from other system binaries.

If the box is cracked, then you can expect the crackers programs to be
re-started at boot time, so you should also look in your
/etc/rc.d/rc.local & /etc/rc.d/init.d files for unusual configurations. 
Again, recent creation dates are a clue.

A simple and easy checker is to download chkrootkit from
http://www.chkrootkit.org build it and run it.  It's not perfect, but it
will find evidence of a compromise if there has been one. 

> Should I be worried?  (I already am :-(  )

Worried is good ... it will keep you on your toes.
 
> Should I not use my internal network till I reformat and relaod my
> RH62 server?

Gather evidence of a compromise first.

-- 
Regards
Luke
------
Q:  What does FAQ stand for?
A:  We are Frequently Asked this Question, and we have no idea.
------
C.O.L.S FAQ - http://www.linuxsecurity.com/docs/colsfaq.html
------