🚀 go-pugleaf

Hi all!

I've been having real security troubles with my Linux system
at home.  I'm running Red Hat 5.2 with kernel 2.0.36.  A
few weeks ago, someone hacked into my system and (I think)
they had boot root access and my password.  By the time I
figured out that something was wrong, all my log files had
been over-written and I didn't have the information I needed
to figure out what went wrong.  It looks like they made a
fake login binary and wrote it to my /bin/ directory that would
record all my passwords and would write those passwords to a
file in my /tmp/ directory.  I saw my password in that
file written many times over.   

I knew something was wrong when I went to log into my own
pc one afternoon and couldn't!  That's what signaled me to
look in the log files.  That's where I noticed that someone
other than myself was logging into my accounts.  But by the
time I returned home to investigate, those files had been
over-written (as I mentioned earlier).  I did notice that
the xferlog was filled with tons of strange characters
(came up as a file filled with '@@@@@' characters).

I think I know how they obtained my passwords, but not how
they actually hacked into an account in the first place.
Maybe something called a 'stack overflow' in ftpd?

I would like to know how to prevent this or other
common attacks in the future.  

This is what I did to try and prevent something like this
from happening again:

I put an entry for every server (except the ones I use at work)
in my hosts.deny file.  That way nobody can try to log in from
machines that I am not familar with.  I changed all my passwords
and use passwords that would never be guessed or used by SATAN.
I went through all my directories to search for files that 
were modified around the time that the hack-in occured.  I 
replaced my bad login file with one from my CD.  Everything is
backed-up; even if someone did something terrible to my computer,
I could bring my system back up to normal.

I guess I must have upset someone very much.  My computer has
been on constant attack ever since then.  All from different
IP's.   I can't even keep up!  They keep trying to login
and keep getting denyed access.  But I did get this message
a few days ago in one of my log files:

Apr  5 23:19:00 ssa58 kernel: Warning: possible SYN flood from 130.102.106.3 on 129.82.XXX.XX:111.  Sending cookies.

Apr  5 23:19:47 portmap[1856]: connect from 130.102.106.3 to getport(mount
d): request from unauthorized host

I don't know what a SYN flood is and if there is anything I can do 
to prevent someone from connecting by this method.  It looks like
simple attacks through telnet have been prevented by filling out
my hosts.deny file.  I wonder why my computer (of all computers)
is sooo interesting?

I guess I wrote this message to try and get some answers to
my security questions and to try and warn people about some
Linux attacks that have been happening on campus.  (none of
the attacks that I have noticed have come from a CSU computer).

Here is a list of some of the IP's of the machines used to
attack my Linux system:

*.skima.is  [212.30.194.*]  this person was bouncing from IP to IP.

128.134.171.28

Is there any way to refuse httpd service to certain servers as well?
I didn't see any information about this in the man pages.

Thanks for reading through all this;  I was very stressed out
about having lost control of my own computer at home and am
doing everthing I can to prevent it from happening again.
I'm not a CS student or anything like that.  So please be
gentle.

Free phone sex to anyone who can help me out! ;)

Thanks,

Camille Keeler
Dept. of Chemistry
CSU Ft. Collins, CO 80521