8:28 a.m.
The last two days i got bugged by someone from korea and someone from japan.
his is what i find in my LogWatch :
--------------------- SSHD Begin ------------------------
Failed logins from these:
guest/password from ::ffff:211.119.136.170: 1 Time(s)
test/password from ::ffff:211.119.136.170: 1 Time(s)
Illegal users from these:
guest/none from ::ffff:211.119.136.170: 1 Time(s)
guest/password from ::ffff:211.119.136.170: 1 Time(s)
test/none from ::ffff:211.119.136.170: 1 Time(s)
test/password from ::ffff:211.119.136.170: 1 Time(s)
is this a known hack attempt by some sort of program ? because for both
tries the same usernames have been tried to use : guest and test
cheers
Edwin
8:32 a.m.
>>>> "Edwin" == Edwin Dicker
<edwin(a)dicker.nl> writes:
Edwin> The last two days i got bugged by someone from korea and
Edwin> someone from japan. his is what i find in my LogWatch :
Edwin> --------------------- SSHD Begin ------------------------
Edwin> Failed logins from these: guest/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s)
Edwin> Illegal users from these: guest/none from
Edwin> ::ffff:211.119.136.170: 1 Time(s) guest/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/none from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s)
Edwin> is this a known hack attempt by some sort of program ?
Edwin> because for both tries the same usernames have been tried
Edwin> to use : guest and test
I've also seen this the last couple of days, and from the same IP address.
--
Colin Paul Adams
Preston Lancashire
8:46 a.m.
On Sat, 2004-07-24 at 09:32, Colin Paul Adams wrote:
>>>>> "Edwin" == Edwin Dicker
<edwin(a)dicker.nl> writes:
Edwin> The last two days i got bugged by someone from korea and
Edwin> someone from japan. his is what i find in my LogWatch :
Edwin> --------------------- SSHD Begin ------------------------
Edwin> Failed logins from these: guest/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s)
Edwin> Illegal users from these: guest/none from
Edwin> ::ffff:211.119.136.170: 1 Time(s) guest/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/none from
Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
Edwin> ::ffff:211.119.136.170: 1 Time(s)
Edwin> is this a known hack attempt by some sort of program ?
Edwin> because for both tries the same usernames have been tried
Edwin> to use : guest and test
I've also seen this the last couple of days, and from the same IP address.
--
Colin Paul Adams
Preston Lancashire
Are you using DSL or cable modem? If so you really should invest in a
cheap hardware router. It is amazing how much that will protect you.
You may want to block that IP address in iptables just to be on the safe
side.
Most likely a script kiddie running some software they found.
--
Scot L. Harris
webid(a)cfl.rr.com
Necessity is a mother.
7:44 a.m.
Am Sa, den 24.07.2004 schrieb Scot L. Harris um 15:46:
> Edwin> The last two days i got bugged by someone from
korea and
> Edwin> someone from japan. his is what i find in my LogWatch :
> Edwin> --------------------- SSHD Begin ------------------------
>
>
> Edwin> Failed logins from these: guest/password from
> Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
> Edwin> ::ffff:211.119.136.170: 1 Time(s)
>
> Edwin> Illegal users from these: guest/none from
> Edwin> ::ffff:211.119.136.170: 1 Time(s) guest/password from
> Edwin> ::ffff:211.119.136.170: 1 Time(s) test/none from
> Edwin> ::ffff:211.119.136.170: 1 Time(s) test/password from
> Edwin> ::ffff:211.119.136.170: 1 Time(s)
>
> Edwin> is this a known hack attempt by some sort of program ?
> Edwin> because for both tries the same usernames have been tried
> Edwin> to use : guest and test
Are you using DSL or cable modem? If so you really should invest in
a
cheap hardware router. It is amazing how much that will protect you.
You may want to block that IP address in iptables just to be on the safe
side.
Most likely a script kiddie running some software they found.
Scot L. Harris
Certainly some scripts kids active. I had investigated now a couple of
machines from where these attempts reached me or friends hosts. This is
what I can conclude:
1) The machines from where these attempts come are already hacked: they
have a rootkit running which lets run an SSHD version 1.2.25 on a high
port. Most often there is a telnet daemon running too.
2) Most of the hacking machines have an old and vulnerable SSHD running.
3) They have too an old and vulnerable kernel running.
4) Many of the machines are older Redhat releases, I saw a lot of RH8.
5) The script connecting on SSH with user test and guest is checking the
SSH version and how the SSH reacts besides the plain version reply. This
way it can find out whether the host is a good target for the second
step.
6) I was on one hacking host because the rootkit on it - Fuck'it Rootkit
- had the default password (rootme) and I tried to find out more details
about what the kids do. I found scripts doing the SSH connection tests
and also a list of target IPs the script automatically send to a
Romanian email address. The admins of the host were absolutely clueless
- astonishing it was a central host of a Pakistanian internet provider,
holding radius data, data about customers and their usage of the
services they offer. The host was a default Redhat 8 host with not any
update package installed! Unfortunately all my mail to administrative
addresses I found out by whois data came back, so I had to inform them
by modifying the /etc/motd and kicking the real root some time, so they
had chance to read the motd information. At all it took more than 24
hours until they finally closed the bad hole. Though I am not sure they
really changed anything on the host so that in future any further hack
over the vulnerable SSHD can take place.
Finally: firewalling is certainly a very good thing - but most important
is to keep the system as much up to date as it is possible!
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.7-1.494.2.2smp
Serendipity 14:23:38 up 2 days, 7:51, load average: 0.51, 0.35, 0.20
9:57 a.m.
On Fri, 2004-08-06 at 08:44, Alexander Dalloz wrote:
Certainly some scripts kids active. I had investigated now a couple
of
machines from where these attempts reached me or friends hosts. This is
what I can conclude:
1) The machines from where these attempts come are already hacked: they
have a rootkit running which lets run an SSHD version 1.2.25 on a high
port. Most often there is a telnet daemon running too.
2) Most of the hacking machines have an old and vulnerable SSHD running.
3) They have too an old and vulnerable kernel running.
4) Many of the machines are older Redhat releases, I saw a lot of RH8.
5) The script connecting on SSH with user test and guest is checking the
SSH version and how the SSH reacts besides the plain version reply. This
way it can find out whether the host is a good target for the second
step.
6) I was on one hacking host because the rootkit on it - Fuck'it Rootkit
- had the default password (rootme) and I tried to find out more details
about what the kids do. I found scripts doing the SSH connection tests
and also a list of target IPs the script automatically send to a
Romanian email address. The admins of the host were absolutely clueless
- astonishing it was a central host of a Pakistanian internet provider,
holding radius data, data about customers and their usage of the
services they offer. The host was a default Redhat 8 host with not any
update package installed! Unfortunately all my mail to administrative
addresses I found out by whois data came back, so I had to inform them
by modifying the /etc/motd and kicking the real root some time, so they
had chance to read the motd information. At all it took more than 24
hours until they finally closed the bad hole. Though I am not sure they
really changed anything on the host so that in future any further hack
over the vulnerable SSHD can take place.
Finally: firewalling is certainly a very good thing - but most important
is to keep the system as much up to date as it is possible!
Alexander
Just be careful trying to fix root'ed hosts yourself. I would hate to
see you get in trouble.
BTW: Nice trick with the motd. :)
--
Scot L. Harris
webid(a)cfl.rr.com
You put the disk in upside down.
8:48 a.m.
On Sat, 2004-07-24 at 06:28, Edwin Dicker wrote:
The last two days i got bugged by someone from korea and someone from
japan.
his is what i find in my LogWatch :
--------------------- SSHD Begin ------------------------
Failed logins from these:
guest/password from ::ffff:211.119.136.170: 1 Time(s)
test/password from ::ffff:211.119.136.170: 1 Time(s)
Illegal users from these:
guest/none from ::ffff:211.119.136.170: 1 Time(s)
guest/password from ::ffff:211.119.136.170: 1 Time(s)
test/none from ::ffff:211.119.136.170: 1 Time(s)
test/password from ::ffff:211.119.136.170: 1 Time(s)
is this a known hack attempt by some sort of program ? because for both
tries the same usernames have been tried to use : guest and test
cheers
Edwin
I have seen a lot of this lately too. I've just started blocking each
individual IP address as it comes up so they can't try again.
--
Thanks,
Tom Sapp
http://www.sappsworld.com
10:56 a.m.
On Jul 24, 2004 at 06:48, Thomas Sapp in a soothing rage wrote:
On Sat, 2004-07-24 at 06:28, Edwin Dicker wrote:
> The last two days i got bugged by someone from korea and someone from japan.
> his is what i find in my LogWatch :
> --------------------- SSHD Begin ------------------------
>
>
> Failed logins from these:
> guest/password from ::ffff:211.119.136.170: 1 Time(s)
> test/password from ::ffff:211.119.136.170: 1 Time(s)
>
> Illegal users from these:
> guest/none from ::ffff:211.119.136.170: 1 Time(s)
> guest/password from ::ffff:211.119.136.170: 1 Time(s)
> test/none from ::ffff:211.119.136.170: 1 Time(s)
> test/password from ::ffff:211.119.136.170: 1 Time(s)
>
> is this a known hack attempt by some sort of program ? because for both
> tries the same usernames have been tried to use : guest and test
>
> cheers
> Edwin
I have seen a lot of this lately too. I've just started blocking each
individual IP address as it comes up so they can't try again.
I've noticed
these too. I do a
$IPT -A INPUT -s 192.168.52.0/24 -p tcp --syn --destination-port 22 -j ACCEPT
instead. This will only ssh packets for machines that are on my local
network. I have a duplicate rule for work machines that I connect
from. All other traffic gets dropped. Telnet is not running on any of
my machines.
N.Emile...
--
Registered Linux User # 125653 (http://counter.li.org)
Switch to: http://www.speakeasy.net/refer/190653
Love means nothing to a tennis player.
11:52:01 up 26 days, 5:07, 4 users, load average: 0.00, 0.00, 0.00
9:08 a.m.
On Saturday 24 July 2004 9:28 am, Edwin Dicker wrote:
The last two days i got bugged by someone from korea and someone
from
japan. his is what i find in my LogWatch :
Hi,
Just like Scot says..you should buy a hardware router ..most of them have
firewall capabilities built-in.
Also, go to:
https://grc.com/x/ne.dll?bh0bkyd2
and see how safe you are. This site will scan common ports (or all if you
want) and you'll see how exposed you are. I highly recommend it.
Jorge
11:34 a.m.
On Sat, Jul 24, 2004 at 10:08:48 -0400,
Jorge Fábregas <fabregasj(a)prtc.net> wrote:
On Saturday 24 July 2004 9:28 am, Edwin Dicker wrote:
> The last two days i got bugged by someone from korea and someone from
> japan. his is what i find in my LogWatch :
Just like Scot says..you should buy a hardware router ..most of them have
firewall capabilities built-in.
I disagree. Hardware routers are pretty much just software routers that
you don't (generally) have access to the source for, are harder to update,
and may have backdoors as a recent Netgear model did. The router manufacturers
have incentive to put in backdoors to cut support costs.
There are advantages to having a firewall that is on a separate physical
machine, but hardwall firewalls aren't magically better than locked
down linux boxes not running public services. They may be cheaper, particularly
if you don't have an old box sitting around that you can use for a firewall.
Even having a separate firewall doesn't buy you that much if you are protecting
linux (or BSD) machines as they have very powerful packet filtering software.
The main advantages are some convenience bringing up new machines (as they
can be attached to the network before being fully hardened) and that since
in theory the firewall should be more secure, it is likely to be able to
prevent outbound attacks after a compromise which a packet filter on a root
compromised machine won't be able to do.
11:56 a.m.
On Sat, 2004-07-24 at 12:34, Bruno Wolff III wrote:
I disagree. Hardware routers are pretty much just software routers
that
you don't (generally) have access to the source for, are harder to update,
and may have backdoors as a recent Netgear model did. The router manufacturers
have incentive to put in backdoors to cut support costs.
There are advantages to having a firewall that is on a separate physical
machine, but hardwall firewalls aren't magically better than locked
down linux boxes not running public services. They may be cheaper, particularly
if you don't have an old box sitting around that you can use for a firewall.
Even having a separate firewall doesn't buy you that much if you are protecting
linux (or BSD) machines as they have very powerful packet filtering software.
The main advantages are some convenience bringing up new machines (as they
can be attached to the network before being fully hardened) and that since
in theory the firewall should be more secure, it is likely to be able to
prevent outbound attacks after a compromise which a packet filter on a root
compromised machine won't be able to do.
For those that have the skills, time, equipment, money, a hardened linux
box may be a good alternative. For the vast majority of people out
there that really just want to use their system for email, web browsing,
games, and possibly some actual work, a simple dedicated inexpensive
router/firewall will do a very good job. True it does not have all the
features of a full blown firewall box but then most people don't need
fine grained access controls or the ability to filter or trap specific
packets.
For the price of between 40 and 60 dollars such a firewall can prevent
most if not all attempts at getting at systems sitting behind it. The
kind of probing mentioned here is just the kind of thing that such a
firewall would deflect very easily.
Also, using a dedicated single purpose device usually eliminates a large
number of the potential holes that a more complex powerful box may
suffer from if improperly configured. Less options equal fewer chances
to miss-configure things.
I have started the process to build a linux based firewall. I figure it
will take several weeks if not more to get something that I feel is
secure enough to actually connect directly to the Internet. Plus I have
to sort out installation and operation of some very complicated software
(iptables, snort, possibly shorewall, tripwire, etc) And once I put it
in place I will no doubt have to spend time every day monitoring it to
make sure things continue to work as expected. At some point I may find
it is not worth it and revert back to a much simpler device. But I
figure this is a good learning exercise for myself.
Plus I will continue to run iptables on the systems behind the firewall
along with tripwire as a second line of defense.
For those that just want to make use of a computer attached to the
Internet via a broadband connection 40 to 60 dollars is well worth it in
most cases. It not only protects them but keeps their systems from
being used to spam and DDOS other peoples systems.
--
Scot L. Harris
webid(a)cfl.rr.com
If one cannot enjoy reading a book over and over again, there is no use
in reading it at all.
-- Oscar Wilde
9:39 p.m.
On Sat, 2004-07-24 at 11:56, Scot L. Harris wrote:
On Sat, 2004-07-24 at 12:34, Bruno Wolff III wrote:
> I disagree. Hardware routers are pretty much just software routers that
> you don't (generally) have access to the source for, are harder to update,
> and may have backdoors as a recent Netgear model did. The router manufacturers
> have incentive to put in backdoors to cut support costs.
>
> There are advantages to having a firewall that is on a separate physical
> machine, but hardwall firewalls aren't magically better than locked
> down linux boxes not running public services. They may be cheaper, particularly
> if you don't have an old box sitting around that you can use for a firewall.
>
> Even having a separate firewall doesn't buy you that much if you are protecting
> linux (or BSD) machines as they have very powerful packet filtering software.
> The main advantages are some convenience bringing up new machines (as they
> can be attached to the network before being fully hardened) and that since
> in theory the firewall should be more secure, it is likely to be able to
> prevent outbound attacks after a compromise which a packet filter on a root
> compromised machine won't be able to do.
For those that have the skills, time, equipment, money, a hardened linux
box may be a good alternative. For the vast majority of people out
there that really just want to use their system for email, web browsing,
games, and possibly some actual work, a simple dedicated inexpensive
router/firewall will do a very good job. True it does not have all the
features of a full blown firewall box but then most people don't need
fine grained access controls or the ability to filter or trap specific
packets.
For the price of between 40 and 60 dollars such a firewall can prevent
most if not all attempts at getting at systems sitting behind it. The
kind of probing mentioned here is just the kind of thing that such a
firewall would deflect very easily.
Not true. If you want ssh access to your box you would have to open up
port 22 (or some other custom port) and forward it from the firewall box
to your box. Thus this attack style would still reach the "protected
box".
Also, using a dedicated single purpose device usually eliminates a
large
number of the potential holes that a more complex powerful box may
suffer from if improperly configured. Less options equal fewer chances
to miss-configure things.
I have started the process to build a linux based firewall. I figure it
will take several weeks if not more to get something that I feel is
secure enough to actually connect directly to the Internet. Plus I have
to sort out installation and operation of some very complicated software
(iptables, snort, possibly shorewall, tripwire, etc) And once I put it
in place I will no doubt have to spend time every day monitoring it to
make sure things continue to work as expected. At some point I may find
it is not worth it and revert back to a much simpler device. But I
figure this is a good learning exercise for myself.
Plus I will continue to run iptables on the systems behind the firewall
along with tripwire as a second line of defense.
For those that just want to make use of a computer attached to the
Internet via a broadband connection 40 to 60 dollars is well worth it in
most cases. It not only protects them but keeps their systems from
being used to spam and DDOS other peoples systems.
--
Scot L. Harris
webid(a)cfl.rr.com
If one cannot enjoy reading a book over and over again, there is no use
in reading it at all.
-- Oscar Wilde
7:01 a.m.
On Sat, 2004-07-24 at 18:56, Scot L. Harris wrote:
On Sat, 2004-07-24 at 12:34, Bruno Wolff III wrote:
> I disagree. Hardware routers are pretty much just software routers that
> you don't (generally) have access to the source for, are harder to update,
> and may have backdoors as a recent Netgear model did. The router manufacturers
> have incentive to put in backdoors to cut support costs.
>
> There are advantages to having a firewall that is on a separate physical
> machine, but hardwall firewalls aren't magically better than locked
> down linux boxes not running public services. They may be cheaper, particularly
> if you don't have an old box sitting around that you can use for a firewall.
>
> Even having a separate firewall doesn't buy you that much if you are protecting
> linux (or BSD) machines as they have very powerful packet filtering software.
> The main advantages are some convenience bringing up new machines (as they
> can be attached to the network before being fully hardened) and that since
> in theory the firewall should be more secure, it is likely to be able to
> prevent outbound attacks after a compromise which a packet filter on a root
> compromised machine won't be able to do.
For those that have the skills, time, equipment, money, a hardened linux
box may be a good alternative. For the vast majority of people out
there that really just want to use their system for email, web browsing,
games, and possibly some actual work, a simple dedicated inexpensive
router/firewall will do a very good job. True it does not have all the
features of a full blown firewall box but then most people don't need
fine grained access controls or the ability to filter or trap specific
packets.
For the price of between 40 and 60 dollars such a firewall can prevent
most if not all attempts at getting at systems sitting behind it. The
kind of probing mentioned here is just the kind of thing that such a
firewall would deflect very easily.
Also, using a dedicated single purpose device usually eliminates a large
number of the potential holes that a more complex powerful box may
suffer from if improperly configured. Less options equal fewer chances
to miss-configure things.
I disagree with you and share the opinion of Bruno. If you want to
have other ports open than just simple HTTP or FTP, you'll end up in
spending at least the same amount of hours with configuring your box
like you would spend with your own Linux. (For example I wasn't able to
properly set up an SMC router to let DC++ out/in but filter other
outgoing packets.)
They're simply cheaper, more silent, consume less power, dissipate
less heap and need less cables. They don't protect better.
8:36 a.m.
On Mon, 2004-07-26 at 08:01, Botond Kardos wrote:
On Sat, 2004-07-24 at 18:56, Scot L. Harris wrote:
>
> For those that have the skills, time, equipment, money, a hardened linux
> box may be a good alternative. For the vast majority of people out
> there that really just want to use their system for email, web browsing,
> games, and possibly some actual work, a simple dedicated inexpensive
> router/firewall will do a very good job. True it does not have all the
> features of a full blown firewall box but then most people don't need
> fine grained access controls or the ability to filter or trap specific
> packets.
>
> For the price of between 40 and 60 dollars such a firewall can prevent
> most if not all attempts at getting at systems sitting behind it. The
> kind of probing mentioned here is just the kind of thing that such a
> firewall would deflect very easily.
>
> Also, using a dedicated single purpose device usually eliminates a large
> number of the potential holes that a more complex powerful box may
> suffer from if improperly configured. Less options equal fewer chances
> to miss-configure things.
>
I disagree with you and share the opinion of Bruno. If you want to
have other ports open than just simple HTTP or FTP, you'll end up in
spending at least the same amount of hours with configuring your box
like you would spend with your own Linux. (For example I wasn't able to
properly set up an SMC router to let DC++ out/in but filter other
outgoing packets.)
They're simply cheaper, more silent, consume less power, dissipate
less heap and need less cables. They don't protect better.
Please note I said "For the vast majority of people..." a cheap hardware
router/firewall will provide more than sufficient protection without
them having to spend inordinate amounts of time learning how to properly
configure security on their systems. Is it perfect, no. Is it better
than nothing or an improperly setup system, yes.
For someone new to computers or just new to linux such a device can buy
them the time to learn and use the system. I have seen reports that
indicate a brand new Windows box connected directly to the Internet will
be infected within 10 minutes. Have seen many people trying to figure
out how to get all the updates in place on a system before they lose
control.
Can you harden a linux system as good or better than a cheap hardware
firewall, you may be able to today, someone new maybe not.
And if you are poking holes through the firewall, whether it be a
hardware firewall or iptables on a linux box, you need to know what you
are doing and the risks you are taking.
Many times people need to have various services open on a system such as
ssh or ftp which are used only locally on the LAN. With a separate
hardware firewall in place those services are not exposed to the
Internet and probes would not reach the server.
The vast majority of people out there have no need to open ssh to the
Internet or use DC++. For those that do have that need they hopefully
understand the risks and take precautions, ie. use good passwords,
updated software, implement IDS services, monitor log files.
I don't think I ever said that a hardware router/firewall was better
protection, I do believe that for the vast majority of people out there
such a device is easier to setup and less prone to configuration errors
than getting a linux server configured securely. You personally may
fall in the minority that knows how to properly set things up or needs
services that are not available on these inexpensive routers.
And as has been mentioned, the best protection is using good passwords
on what ever services you expose.
Also, there are dozens of ways to configure a server and a LAN. All of
them are valid, some are better in certain situations than others.
--
Scot L. Harris
webid(a)cfl.rr.com
The sight of death frightens them [Earthers].
-- Kras the Klingon, "Friday's Child", stardate 3497.2
8:54 a.m.
Can you harden a linux system as good or better than a cheap
hardware
firewall, you may be able to today, someone new maybe not.
Well, there's always firewall-specific distros - smoothwall and the like. I'm
pretty sure a newbie could work out how to set up a hardened Linux network in
less than 10 minuites with a Smoothwall CD. Ok, that's slightly cheating
because it's turning an old computer into a cheap hardware firewall.
Besides, I've always thought the default security with Redhat/Fedora was
pretty good. Just not selecting any services to let through the local
firewall in the graphical installer should be good enough.
9:17 a.m.
On Mon, 2004-07-26 at 09:54, Jim Higson wrote:
> Can you harden a linux system as good or better than a cheap
hardware
> firewall, you may be able to today, someone new maybe not.
Well, there's always firewall-specific distros - smoothwall and the like. I'm
pretty sure a newbie could work out how to set up a hardened Linux network in
less than 10 minuites with a Smoothwall CD. Ok, that's slightly cheating
because it's turning an old computer into a cheap hardware firewall.
The BEST, simplest, most obvious GUI I have ever found was the WEBMIN
module for IPTables. By then reviewing the resulting iptables file, I
learned enough to eliminate Webmin.
9:23 a.m.
On Mon, 2004-07-26 at 09:54, Jim Higson wrote:
> Can you harden a linux system as good or better than a cheap
hardware
> firewall, you may be able to today, someone new maybe not.
Well, there's always firewall-specific distros - smoothwall and the like. I'm
pretty sure a newbie could work out how to set up a hardened Linux network in
less than 10 minuites with a Smoothwall CD. Ok, that's slightly cheating
because it's turning an old computer into a cheap hardware firewall.
Good points. But how many newbie's have spare equipment laying around
and know about smoothwall day one? I did not. There was a learning
curve that we all climb at our own speed. As you learn more you change
your system to use new things. When you setup a second system you
probably set it up differently that you did the first system due to what
you have learned.
Besides, I've always thought the default security with
Redhat/Fedora was
pretty good. Just not selecting any services to let through the local
firewall in the graphical installer should be good enough.
It is good if you leave it at its highest settings, no ssh, no ftp, etc
through the firewall, block everything. But many people want to access
their shiny new linux box using samba or ftp or telnet or ssh. Those
get punched through early on so they can access other systems on their
LAN or share a directory with that windows machine.
If they have a spare box to configure as a firewall great. If not a
cheap hardware router does a great job with a lot less fuss and probably
more securely than a first time implementation of smoothwall.
And like I said before poor passwords are more of a problem that most
other things. I seem to recall a thread in this very group talking
about how to setup a system WITHOUT any passwords at all. I just
shudder at the thought.
I ran a program once on a Vax 11/780 which was able to crack something
better than 60% of the passwords on that system. (I was system admin at
the time and I had informed my boss what I was doing....) Was kind of
funny when I went to my boss and told him to change his password since
he had selected a poor one.
And setting up a layered defense makes it more difficult to identify and
hack systems from external connections. This is one of the reasons most
companies implement DMZs which separate Internet facing systems from
internal LANs. But that is straying from the discussion. :)
--
Scot L. Harris
webid(a)cfl.rr.com
The older a man gets, the farther he had to walk to school as a boy.
11:45 a.m.
(Sorry, I missed the original post, that's why I reply here.)
I have seen reports that indicate a brand new Windows
box connected directly to the Internet will be infected
within 10 minutes.
OFF topic here, but might be interesting:
mine was infected in about 1 minute when I started experimenting with
DMZ, and a colleague of mine reported 4 minutes. :)
11:59 a.m.
New subject: [OT] Hack attempts
On Mon, 2004-07-26 at 12:45, Botond Kardos wrote:
(Sorry, I missed the original post, that's why I reply
here.)
> I have seen reports that indicate a brand new Windows
> box connected directly to the Internet will be infected
> within 10 minutes.
OFF topic here, but might be interesting:
mine was infected in about 1 minute when I started experimenting with
DMZ, and a colleague of mine reported 4 minutes. :)
I was being conservative in giving it 10 minutes. :)
Your results are similar to reports I had heard as well. Luckily I have
not witnessed such first hand (that I know of).
And yes, it is interesting. Hard to believe just how hostile an
environment the Internet has become.
--
Scot L. Harris
webid(a)cfl.rr.com
The cost of living is going up, and the chance of living is going down.
9:37 p.m.
--On Monday, July 26, 2004 10:23 AM -0400 "Scot L. Harris"
<webid(a)cfl.rr.com> wrote:
If they have a spare box to configure as a firewall great. If not a
cheap hardware router does a great job with a lot less fuss and probably
more securely than a first time implementation of smoothwall.
Get the best of both worlds. I just got a Linksys WRT54G, which runs Linux
on a MIPS processor and has a fair amount of Flash. Linksys provides the
GPL'd source so you can recreate what's in the box. Google for "Linksys
Linux router" for lots of articles on what you can do with it. Or grab a
custom Linux image from http://www.sveasoft.com/.
11:30 p.m.
Or http://www.freesco.org for a free firewall and I'll bet you can find
someone with a 386 that will give it to you for nothing.
T
On Thu, 2004-08-05 at 19:37, Kenneth Porter wrote:
--On Monday, July 26, 2004 10:23 AM -0400 "Scot L. Harris"
<webid(a)cfl.rr.com> wrote:
> If they have a spare box to configure as a firewall great. If not a
> cheap hardware router does a great job with a lot less fuss and probably
> more securely than a first time implementation of smoothwall.
Get the best of both worlds. I just got a Linksys WRT54G, which runs Linux
on a MIPS processor and has a fair amount of Flash. Linksys provides the
GPL'd source so you can recreate what's in the box. Google for "Linksys
Linux router" for lots of articles on what you can do with it. Or grab a
custom Linux image from http://www.sveasoft.com/.
1:17 a.m.
--On Thursday, August 05, 2004 9:30 PM -0700 Timothy Payne <tim(a)tmpco.com>
wrote:
Or http://www.freesco.org for a free firewall and I'll bet you
can find
someone with a 386 that will give it to you for nothing.
I've used freesco on a discarded "doorstop" box for a cheap print server
when the company wouldn't authorize a JetDirect. Works well if you don't
mind the space it takes up. Just turn off the monitor and remove any hard
disks to cut power consumption. (Freesco runs from a floppy.)
8:55 a.m.
On Mon, 2004-07-26 at 08:01, Botond Kardos wrote:
>
> I disagree with you and share the opinion of Bruno. If you want to
> have other ports open than just simple HTTP or FTP, you'll end up in
> spending at least the same amount of hours with configuring your box
> like you would spend with your own Linux. (For example I wasn't able to
> properly set up an SMC router to let DC++ out/in but filter other
> outgoing packets.)
> They're simply cheaper, more silent, consume less power, dissipate
> less heap and need less cables. They don't protect better.
There is one additional difference: if someone hacks the router, you can
always power-cycle it (unless they manage to infect the firmware) to
return to the original setup. To do the same with a normal box, you
would have to have it set up using read-only media (boot from CD or the
like).
9:56 a.m.
On Mon, 2004-07-26 at 15:55, Aaron Gaudio wrote:
> On Mon, 2004-07-26 at 08:01, Botond Kardos wrote:
> >
> > I disagree with you and share the opinion of Bruno. If you want to
> > have other ports open than just simple HTTP or FTP, you'll end up in
> > spending at least the same amount of hours with configuring your box
> > like you would spend with your own Linux. (For example I wasn't able to
> > properly set up an SMC router to let DC++ out/in but filter other
> > outgoing packets.)
> > They're simply cheaper, more silent, consume less power, dissipate
> > less heap and need less cables. They don't protect better.
>
There is one additional difference: if someone hacks the router, you can
always power-cycle it (unless they manage to infect the firmware) to
return to the original setup. To do the same with a normal box, you
would have to have it set up using read-only media (boot from CD or the
like).
For this reason I keep a copy of the whole /etc directory of my
firewall in a safe place. But one can have a complete HD image too. :)
12:56 p.m.
Hi,
Just like Scot says..you should buy a hardware router ..most of them have
firewall capabilities built-in.
Also, go to:
https://grc.com/x/ne.dll?bh0bkyd2
and see how safe you are. This site will scan common ports (or all if you
want) and you'll see how exposed you are. I highly recommend it.
Of course I agree with you all, except for the fact that a HW firewall
should be any better than a well setup linux box.
My system has been setup quite well I believe and has only ssh and http
open. By using well thought of passwords I feel that my system has enough
protection to keep anyone off the system who doesnt belong there.
The only thing where I was curious about was that the two attempts used
exactly the same names : guest and test, and therefore I was suspecting (
like Scott mentioned ) a kiddie with some code.
Anyway... I'm glad that I posted it and found not to be the only one
'bothered' from that IP.
Cheers
Edwin
3:14 p.m.
Or a free firewall at www.freesco.org
On Sat, 2004-07-24 at 10:56, Edwin Dicker wrote:
> Hi,
>
> Just like Scot says..you should buy a hardware router ..most of them have
> firewall capabilities built-in.
>
> Also, go to:
>
> https://grc.com/x/ne.dll?bh0bkyd2
>
> and see how safe you are. This site will scan common ports (or all if you
> want) and you'll see how exposed you are. I highly recommend it.
Of course I agree with you all, except for the fact that a HW firewall
should be any better than a well setup linux box.
My system has been setup quite well I believe and has only ssh and http
open. By using well thought of passwords I feel that my system has enough
protection to keep anyone off the system who doesnt belong there.
The only thing where I was curious about was that the two attempts used
exactly the same names : guest and test, and therefore I was suspecting (
like Scott mentioned ) a kiddie with some code.
Anyway... I'm glad that I posted it and found not to be the only one
'bothered' from that IP.
Cheers
Edwin
1:30 p.m.
On Jul 24, 2004, at 10:08 AM, Jorge Fábregas wrote:
Just like Scot says..you should buy a hardware router ..most of them
have
firewall capabilities built-in.
People somehow think that because they don't have to load an operating
system onto a device that it's not just a computer running software.
Newsflash: your so-called "hardware router" is nothing more than a
small-scale CPU, memory, some network interfaces and some sort of
embedded OS. In many cases, the OS is even Linux - case in point, the
extremely popular Linksys WRT54G line.
--j
2:19 p.m.
On Sat, 2004-07-24 at 14:30, Jason Costomiris wrote:
On Jul 24, 2004, at 10:08 AM, Jorge Fábregas wrote:
> Just like Scot says..you should buy a hardware router ..most of them
> have
> firewall capabilities built-in.
People somehow think that because they don't have to load an operating
system onto a device that it's not just a computer running software.
Newsflash: your so-called "hardware router" is nothing more than a
small-scale CPU, memory, some network interfaces and some sort of
embedded OS. In many cases, the OS is even Linux - case in point, the
extremely popular Linksys WRT54G line.
--j
Very true. But such a hardware router is a dedicated appliance with few
options and no other task than to provide some protection.
It can take a very complex service that even seasoned firewall experts
get wrong at times and make it available to the general public.
And since it is a dedicated device with few if any extraneous services,
while not impossible, it is very unlikely that a general exploit will
get through one.
Nothing is perfect. That is why I subscribe to defense in depth. Use a
separate firewall as well as iptables and other IDS software on the
servers with good passwords etc.
In the end all it really does is make it more difficult for the really
determined attacker to get to the data they are after. The only secure
system is one that is not connected to the Internet, unplugged, locked
in a vault on the moon. And even that system is subject to being stolen
given enough time and money. Of course it is not very useful in that
state.
--
Scot L. Harris
webid(a)cfl.rr.com
What's love but a second-hand emotion?
-- Tina Turner
2:25 p.m.
On Sat, 2004-07-24 at 12:19, Scot L. Harris wrote:
In the end all it really does is make it more difficult for the
really
determined attacker to get to the data they are after. The only secure
system is one that is not connected to the Internet, unplugged, locked
in a vault on the moon. And even that system is subject to being stolen
given enough time and money. Of course it is not very useful in that
state.
--
Scot L. Harris
webid(a)cfl.rr.com
What's love but a second-hand emotion?
-- Tina Turner
Actually, IMHO, the only way to have a secure computer is not to
have
one at all. Any system, secreted away or not, is vulnerable if the
person that is attempting to get in to it is determined enough and has
enough time. Then again, there is always the one computer that most of
us forget about but none of us can live without, the Brain. However,
given the advancing rate of science that will not be that secure for
long! :-)
--
Thanks,
Tom Sapp
http://www.sappsworld.com
2:32 a.m.
On Sat, Jul 24, 2004 at 03:19:18PM -0400, Scot L. Harris wrote:
On Sat, 2004-07-24 at 14:30, Jason Costomiris wrote:
> On Jul 24, 2004, at 10:08 AM, Jorge Fábregas wrote:
>
> > Just like Scot says..you should buy a hardware router ..most of them
> > have
> > firewall capabilities built-in.
>
>
> People somehow think that because they don't have to load an operating
> system onto a device that it's not just a computer running software.
>
> Newsflash: your so-called "hardware router" is nothing more than a
> small-scale CPU, memory, some network interfaces and some sort of
> embedded OS....
....
Very true. But such a hardware router is a dedicated appliance with
few
options and no other task than to provide some protection.
One advantage of an inexpensive firewall is safety in the period of
time when you are setting up a box and have not yet updated all the
patches and configured the system.
One disadvantage is that it is one more thing to learn to configure.
Also an inexpensive NAT box with four ports is very close to the
price of a four port hub. Then there is the wireless RF thing
that most homes seem to need today.
Defense in depth...
--
T o m M i t c h e l l
/dev/dull where insight begins.
4:46 a.m.
On Sun, 2004-07-25 at 08:32, Nifty Hat Mitch wrote:
On Sat, Jul 24, 2004 at 03:19:18PM -0400, Scot L. Harris wrote:
> On Sat, 2004-07-24 at 14:30, Jason Costomiris wrote:
> > On Jul 24, 2004, at 10:08 AM, Jorge Fábregas wrote:
> >
> > > Just like Scot says..you should buy a hardware router ..most of them
> > > have
> > > firewall capabilities built-in.
> >
> >
> > People somehow think that because they don't have to load an operating
> > system onto a device that it's not just a computer running software.
> >
> > Newsflash: your so-called "hardware router" is nothing more than a
> > small-scale CPU, memory, some network interfaces and some sort of
> > embedded OS....
....
> Very true. But such a hardware router is a dedicated appliance with few
> options and no other task than to provide some protection.
One advantage of an inexpensive firewall is safety in the period of
time when you are setting up a box and have not yet updated all the
patches and configured the system.
One disadvantage is that it is one more thing to learn to configure.
It is never bad to have another level of defence between your PC and an
untrusted network, but I ended up switching off the firewall in my
Linksys router because it was dropping ICMP do-not-fragment packets.
This meant path MTU discovery was not working so Postfix was timing out
after DATA on large emails.
Of course, if you don't run your own mail server this isn't a problem.
6:16 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Sunday 25 July 2004 10:46, David Keen wrote:
It is never bad to have another level of defence between your PC and
an
untrusted network, but I ended up switching off the firewall in my
Linksys router because it was dropping ICMP do-not-fragment packets.
This meant path MTU discovery was not working so Postfix was timing out
after DATA on large emails.
Of course, if you don't run your own mail server this isn't a problem.
Some Netgear NAT routers die the death with intensive Bittorrent use. Not
sure what resource gets used up first, but these "Hardware routers" are often
quite weak CPUs combined with very little RAM.
IPCop ( www.ipcop.org ) is a very nice firewall loosely based on RH7.2 with a
lot of powers, and using the 2.4 Linux kernel, no arbitrary limitations
either. I run one here on a flash-based fanless "Book PC" and it has been
just great.
- -Andy
- --
Automatic actions for USB cameras, cardreaders, memory sticks, MP3 players
http://warmcat.com/usbautocam
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBA5aVjKeDCxMJCTIRAjQJAKCYAMcSEyIHKMMs8ksWtT77TJrh9gCdHWCK
tXMHK0Whs2f1VOQEvtPZdWg=
=lShw
-----END PGP SIGNATURE-----
7201
days inactive
7214
days old
30 comments
19 participants
participants (19)
-
Aaron Gaudio -
Alexander Dalloz -
Andy Green -
Botond Kardos -
Bruno Wolff III -
Colin Paul Adams -
David Cary Hart -
David Keen -
Edwin Dicker -
Jason Costomiris -
Jeff Vian -
Jim Higson -
Jorge Fábregas -
Kenneth Porter -
ne... -
Scot L. Harris -
Thomas Sapp -
Tim -
Tom Mitchell