🚀 go-pugleaf

We ve had similar problems as Stefano Pagiola a while ago. Here s a summary of  
the responses I ve got, again. Some of the points are not useful in this  
special case, but of general interest, if you want to improve security.
In our case a hacker probably used the rdist security whole.


1. Is your public sound port on?

2. Check the /etc/cron*

3. Check the lastcomm (/usr/adm/acct on my system) file.
   Before that you must do
       # accton /usr/adm/acct
   Then you can use "sa" to obtain a list of all commands and the user who
   ran it since then.      

4. Are you aware of the rdist promlem?
   There is a security hole in rdist. A fixed version of rdist for NeXT is 
   available at sonata.cc.purdue.edu.
   'rsh' uses the .rhost file in a user's home directory or the global
   /etc/hosts.equiv file.  If a remote user is allowed access via these files
   then no amount of password changing will stop them.


5. There are known methods of attack.  finger, sendmail,  old versions of 
   emacs, ...

6. REMOVE any pd apps you received in binary form.  NEVER AND I MEAN NEVER 
   install pd binaries on ANY machine.  If you can't get the source for the pd    
   stuff then don't install it.

7. Give the machines a boot password.  Anybody can bring a NeXT to single user 
   mode and change password

8. Run Crack and COPS once a week.  (Crack and COPS are available on 
   ftp.uu.net)

9. Do "% /usr/etc/rpcinfo -p"

   If you see a line that begins with 100017 and ends with rexd,
   you have a gaping security hole that allows anyone to execute
   arbitrary commands as any non-root user (and with any group
   access, including wheel group) with essentially no logging.

   Fix: edit /etc/inetd.conf, find the line

   rexd/1         stream  rpc/tcp wait root /usr/etc/rpc.rexd      rpc.rexd

   and insert a # at the beginning.  Then

	"# kill -HUP <inetd's pid>"

   (or reboot).


_________________________________________________________________
Michael Bruewer

e-mail: mib@bio128.uni-bielefeld.de
 
Universitaet Bielefeld