Text 621, 53 rader
Skriven 2004-11-11 12:06:05 av Roy J. Tellason (1:270/615.0)
     Kommentar till en text av Darryl Perry (1:106/324)
Ärende: Sysoping and Getting Hacked
===================================
Darryl Perry wrote in a message to All:

 DP> Hello all!

 DP> I have a slight problem.  My system keeps showing all the symtoms
 DP> of getting hacked.  It happens about once or twice a month.  The
 DP> symtoms are such that some of the files in /bin get altered and
 DP> have 8192 bytes added on to them.  This makes them give a segfault.
 DP> Since apps like grep and awk and mount are affected, my system
 DP> becomes unusable, and I have to rebuild the whole thing from
 DP> scratch.

 DP> I've been told in alt.os.linux that I'm being hacked.

Sounds like there's something of the sort going on,  anyhow.

 DP> They say I should turn off telnet and ftp, because they consider 
 DP> that to be a vulnerability.

Who are "they",  and what specific vulnerabilities are they talking about? 
There are a number of them (vulnerabilities that is) and it's probably not a
bad idea to keep track of this stuff and plug those holes when they become
apparent.

 DP> I'm not sure if they think so because it creates a vulnerable 
 DP> opening in the system, or that hackers can sniff out passwords.

 DP> If it's the latter, then I think I'm covered.  I have it so that
 DP> when anybody connects via telnet, it loads up Mystic.  They never
 DP> get a linux login prompt.  Also, there are no user accounts in
 DP> /etc/passwd other than root and some maintenance accounts.

If there are no user accounts then that's probably not how they're getting in.

 DP> I used to have a menu option that would take me to the OS, but I
 DP> got rid of that.  Now whenever I administrate remotely, I use only
 DP> SSH to do it.

And if you're using ssh I don't know if password sniffing would work (or if the
password is sent in the clear or not).

 DP> So tell me, does any other linux sysop out there have this problem?

Not me.

 DP> What do you do to minimize hacking?

Are you 'net-connected to this box that's giving you the problem?  Using a
firewall?  I have a separate box that's a firewall here,  nothing's gotten past
that yet.

--- 
 * Origin: TANSTAAFL BBS 717-838-8539 (1:270/615)