i got hacked. what were they up to?

bakaohki · Posted: Sat Sep 10, 2005 8:58 pm Post subject:

I shouldn't even bother to post, because what I'm saying is so trivial: USE A DEDICATED FIREWALL :evil:

. Everyone out there. You can use Gentoo, Debian, whatever; I prefer FloppyFW with a fanless dumb P1 75mhz (put together from used garbage). And of course use strong passwords and iptables firewalls for the internal machines. Duh. Surfing on the net without a firewall is like walking around in the city without clothes; if you have weak passwords and opened ssh ports, then it means you're a hot babe without clothes in the worst area of the city at midnight waving a sign "kidnap me"...

audiodef · Posted: Tue Sep 13, 2005 12:27 pm Post subject: Mystery logout

I think someone may have been trying to use my Gentoo box at my office, after hours. I had it up and running one day, screen locked, and logged out the next day. At best, someone hit the computer's reset button, but where would I look to find out exactly what happened? I know it's probably not a power failure because 1. another computer was still on the way I left it and 2. I don't think computer is not set up to reboot after a power failure.

jamapii · l33t Joined: 16 Sep 2004 Posts: 637

There is /var/log/syslog

If it was xlock, maybe it crashed.

Maybe someone switched it off for some reason, then changed their mind and switched it on again.

...

trip · Posted: Mon Sep 26, 2005 7:19 am Post subject:

how do you turn of passwd-less logins? and is making a passwd-less acount as easy as not typing any when creating the acount? sorry for the noobs questions but i want to know exactly what to do in the litle time i have.

tnx in advance
_________________
using linux since may 2005
using gentoo since sept. 2005

Testing and
Research
In
Progress

quantus · n00b Joined: 30 Jul 2002 Posts: 60

nhaggin · n00b Joined: 15 Jun 2002 Posts: 74 Location: Illinois, USA

Reply a little late to this, but I didn't see it until now....

robinmdh · n00b Joined: 01 Oct 2005 Posts: 6

pengatom · n00b Joined: 04 Oct 2004 Posts: 14 Location: Norway

I've got 23 000 "Failed password" logins the laste 3 months... Changed the ssh port, hopfully it gets better

In my iptables I've written:

iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT

would the "ssh" port number change to whatever I set i sshd_conf, or does "ssh" mean port 22?

btw, if I try to set a "easy" password on a user, gentoo tells me this, anyone know what this definition on a "BAD password" is?

Malcolm · Posted: Wed Oct 12, 2005 6:25 pm Post subject:

I've gotten alot of these break-in attempts aswell, both through SSH and FTP. My suggestion is to setup an auto blacklisting script like ssh black.

I've had this setup on my system for 3 days now and the blacklist always has 5-10 IPs, rotating of course

Errtu · Apprentice Joined: 12 Nov 2002 Posts: 155 Location: Brazil

I got tired of maintaining blacklists, scripts and other stuff to keep 'm out, so i just configured sshd to listen on a higher IP. Since i've done that i get no more of these attempts. And my logfile stays a bit cleaner too

Bigun · Advocate Joined: 21 Sep 2003 Posts: 2196

I just grepped over my log and have about 2,000+ pages of attempts ranging back from August of this year.

All of them lame dictionary attempts. Does reporting these IP's to their respective ISP's help anything?
_________________
"It's ok, they might have guns but we have flowers." - Perpetual Victim

christsong84 · Posted: Thu Oct 13, 2005 7:10 pm Post subject:

oracleofmist · Apprentice Joined: 19 Jun 2004 Posts: 235

on top of being behind a router firewall that drops all incoming connections except to specified ports w/ specified protocols i've also take the libery of changing my ftp, ssh services to high port numbers. good practice?
_________________
Segmentation Fault

Bigun · Advocate Joined: 21 Sep 2003 Posts: 2196

chrispolderman · n00b Joined: 12 Oct 2005 Posts: 14

Is there a solid way to traceback the ip number in question and obtaining the abuse email address for the corresponding ISP or am I just speaking nonsense here?

Would be a nice script: more than 20 password tries logged and a process would automatically file a complaint to the corresponding ISP...

Is this possible (apart from spoofed IP's ofcourse)..?

Chris

dsb · n00b Joined: 09 Sep 2004 Posts: 30 Location: MO

My traceroute shows they are coming from China

shiggity s · n00b Joined: 26 Oct 2005 Posts: 11

Those crazy Chinese hackers

Cinder6 · l33t Joined: 05 Aug 2004 Posts: 767 Location: California

I've been getting some from South Korea, and a couple that IP locators can't find

_________________
Knowledge is power.
Power corrupts.
Study hard.
Be evil.

Ugly Overload

Monkeh · Veteran Joined: 06 Aug 2005 Posts: 1656 Location: England

heartburn · n00b Joined: 18 Oct 2002 Posts: 40

I'm not sure if it's been mentioned yet on this thread (it's a very long thread). But you can configure sshd to use DSA authentication instead of PasswordAuthentication. Then, a cracker would need an existing user's private key to use ssh.

You can find the instructions here:
http://www.gentoo.org/doc/en/articles/openssh-key-management-p1.xml?style=printable

Also, logwatch makes a nice daily report of login attempts:

abaelinor · n00b Joined: 27 Aug 2005 Posts: 51

heartburn · n00b Joined: 18 Oct 2002 Posts: 40

like I said, I stole it from timeBandit. He deserves the credit. But I've been using it for about two weeks and it works great. I love hearing my phone make a satisfying chirp every time I log on. And I like hearing nothing when I'm not logging on even better

d11wtq · Posted: Fri Nov 11, 2005 10:38 am Post subject:

Hopefully I've not missed something... I just read 16 pages of thread very quickly. What a great thread!

I run a web server. I'm not being paranoid but this has made me think a lot about security considerations. One thing that worries me is that I have set up user accounts for friends & family on my server (shell accounts/ftp/virtualhost apache accounts) so they can host websites too.

Everyone seems to only be mentioning SSH attacks... all of my users (most know virtually nothing about *nix) have shell access by SSH. The worrying thing is that I'm relying upon them to use secure passwords too now. How can I force increased password security? I want them all to login and do a passwd, then I want passwd to make sure their passwords:

a) Contain at least 8 characters
b) Contain at least 2 numbers
c) Contain a mixture of uppercase and lowercase letters

passwd already forces at least *6* chars but the rest is perfectly allowed

I'm amazed we're only discussing SSH. Is FTP any security risk? It uses the same passwords as the shell access and all users are chrooted to their home directory. Hell... I've even been told you can compromise a box by telnetting to port 80 (HTTP) and doing some magic

I've already installed and changed a few configs during the course of this thread... I may as well do this extra thing with the passwords too. I'll run a "last" command every so often so that users who aren't using SSH have their access removed temporarily too. They'd just get a message upon successful login which says that they need to contact me to have their access re-enabled and then it disconnects again.

Password criteria help anyone?

Errtu · Apprentice Joined: 12 Nov 2002 Posts: 155 Location: Brazil

d11wtq:

Justdoing some searching on freshmeat gives these projects:

http://freshmeat.net/projects/pam_pwcheck/
- The pam_pwcheck is a PAM module for password strength checking

http://freshmeat.net/projects/pam_passwdqc/
- pam_passwdqc is a simple password strength checking module for PAM-aware password changing programs, such as passwd(1).

Maybe one of these could be of help?

Leon

d11wtq · Posted: Fri Nov 11, 2005 10:21 pm Post subject:

Thanks. I've emerged pam_passwdqc so that should help. I haven't set it up yet but it looks simple enough