|
Posted by Unruh on July 6, 2005, 7:19 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>... and I just had a couple of questions to help prevent it again.
>This is an excerpt from the log
>Jun 27 09:37:09 mail sshd[14307]: Accepted password for gerry from
>202.157.176.102 port 2352 ssh2
You had a user gerry? Did he have a trivial password, or did they sniff his
password?
>Jun 27 09:41:44 mail adduser[14366]: new user: name=arnildo, uid=0,
>gid=0, home=/home/arnildo, shell=/bin/bash
>Jun 27 09:42:46 mail sshd[14307]: syslogin_perform_logout: logout()
>returned an error
>Jun 27 09:42:51 mail sshd[14372]: Accepted password for arnildo from
>202.157.176.102 port 2354 ssh2
>Jun 27 12:06:36 mail sshd[16636]: Accepted password for arnildo from
>193.151.75.22 port 2153 ssh2
>So they got in with a standard user account "gerry". But how did he
>subsequently run the 'adduser' command?
Once they are on the machine the rule of thumb is that they will then be
able to get root-- there are so many more possible cracks from inside than
outside.
Or parhaps gerry has root priviledges.
>And why did he bother adding another user at all?
So when gerry changes his password they are not suddenly locked out.
>He created some hidden directories with the ... notation and used the
>machine to send out, of all things, an ebay seller account spam.
Of course. That is how they send out that spam.
>I have switched off password login and use the key based authentication
>only now and further restricted access to port 22 at the firewall.
Well, that may or may not be a good idea. If your users need outside access
it is a bad idea. But it sounds like you need some discussions with your
users.
>Kernel version is 2.4.20-19.8.um.1 so is probably a little dated...
>could this be the root problem?
Sounds like you have not upgraded anything for far too long. If so, then
yes, that is the problem. (2.4.20 sounds like it is part of a system whose
upgrade date has long since passed. Ie, even if you wanted to keep it up to
date you could not. )
>Any help or assistance in this matter would be appreciated ;-)
>Tam
| 
XML site map