I'm trying to configure Mandrake 10.1 as second
level firewall machine but it seems to want to block the local net as well
as the internet port. Has anyone used 10.1 as a firewall?

Eg no file in /tmp, dev /usr/share, ... should be suid root

Does anyone know if Linksys routers are adequate firewalls? I had the FTP
port open but I don't know for sure if that was the route that the
intruders used. I'm trying to configure Mandrake 10.1 as second
level firewall machine but it seems to want to block the local net as well
as the internet port. Has anyone used 10.1 as a firewall?

General Schvantzkoph <schvantzkoph@yahoo.com> writes:

]I'm pretty sure that I've been hacked, I found mldonkey running on one of
]my systems. I had an open FTP port which I normally keep closed but I
]opened for someone to do a download and then forgot to close. I have a
]Linksys router which has open SSH ports and had an open FTP port (which
]is now closed). The machine that was compromised with mldonkey is running
]mandrake 9.2 as is the FTP machine. I ran chkrootkit-0.44 (the latest) on
]all of my machines and it found nothing. There is a restart message in
]the /var/log/messages on all of my systems that has the roughly the same
]time stamp.
]Oct 3 04:02:10 localhost syslogd 1.4.1: restart.

]What else should I do and which logs should I check? Is there another port
]besides FTP that is a likely entry point? Could SSH have been compromised?

]Here are some suspicious entries in the log on the machine that had
]mldonkey,


]/var/log/auth.log

]Oct 3 05:01:02 saratoga msec: set variable SystemMenu to true in /etc/X11/gdm/gdm.conf
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/open_port.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/suid_root.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/suid_md5.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/sgid.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed owner of /var/log/mldonkey.log from mldonkey to root
]Oct 3 05:01:03 saratoga msec: changed group of /var/log/mldonkey.log from mldonkey to adm
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/unowned_group.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed mode of /var/log/security/writable.today from 644 to 640
]Oct 3 05:01:03 saratoga msec: changed mode of
]/var/log/security/unowned_user.today from 644 to 640

These are all fine. -- they are standard msec messages.


] and the following in /var/log/messages

]Oct 3 04:17:49 saratoga :
]Oct 3 04:17:49 saratoga : Security Warning: '+' character found in hosts trusting files,

This is terrible. It allows anyone in the world to connect to your
server. You certainly should not have this. Many users to make it easy to
run from another machine to their own put + into xauth to make it easy.
This is a badbadbadbadbad thinkg to do.

You should tell your sshd not to allow .rhosts and also do not allow
telnet connections.
I don't have telnet installed on any of my machines. SSHD doesn't allow

]Oct 3 04:17:49 saratoga : this probably mean that you trust certains
users/domain ]Oct 3 04:17:49 saratoga : to connect on this host without
proper authentication : ]Oct 3 04:17:49 saratoga : -
/home/bjrosen/.rhosts: + bjrosen

The user bjrosen has done this. Tell him not to do so.
That's me.

Use the .ssh/authorized_hosts file instead.

]Oct 3 04:20:00 saratoga CROND[24005]: (mail) CMD (/usr/bin/python -S
/usr/lib/mailman/cron/gate_news) ]Oct 3 04:22:00 saratoga CROND[24009]:
(root) CMD (nice -n 19 run-parts /etc/cron.weekly) ]Oct 3 04:25:00
saratoga CROND[1608]: (mail) CMD (/usr/bin/python -S
/usr/lib/mailman/cron/gate_news) ]Oct 3 04:30:00 saratoga CROND[1655]:
(root) CMD (/usr/lib/mldonkey/mldonkey_df_monitor.sh)

No idea what mldonkey is, but they have inserted it into root's cron. If
this was done by a stranger, then your system is completely comprimised.
Wipe and reinstall and then use find to look for any suid/sgid files,
and make sure that they should be tehre. Eg no file in /tmp, /dev/
/usr/share, ... should be suid root (I found such files on one of my
comprimised machines.)

General Schvantzkoph wrote:
Does anyone know if Linksys routers are adequate firewalls? I had the FTP
port open but I don't know for sure if that was the route that the
intruders used. I'm trying to configure Mandrake 10.1 as second
level firewall machine but it seems to want to block the local net as well
as the internet port. Has anyone used 10.1 as a firewall?



well, if you pay $40 for a combo firewall/router/dsl device i guess you
can't expect too much? good enough for home use tho.

keep in mind that you can have 2 Cisco PIX firewalls and 2 linux
firewalls in front of your server and still be hacked if you dont
configure your FTP or whatever service correctly. for FTP use vsftpd...
not alot of parameters to screw up... or read some doco on how to
setup these services tightly.

It is not clear to me that mldonkey is from outside. It may be an internal
program included with mandrake 10.1.

On 6 Oct 2004 02:39:51 GMT, Bill Unruh wrote:

It is not clear to me that mldonkey is from outside. It may be an internal
program included with mandrake 10.1.

Not unless the OP loaded it. I always load all package groups and
locate mldonkey
/usr/share/apps/kappfinder/apps/Internet/mldonkey_gui.desktop

on Mandrakelinux release 10.1 (Community) for i586

I have absolutely no recollection of loading it, however I've checked back
on some old logs and found it running back in August.

The FTP port was opened last week, it was not open at any date prior
to that.

I use SSH to do all of my tranfers to my systems, I never use FTP so
that port is always closed.

The other port that was opened was the HTTP port. The only thing
running was the default Mandrake webpage. Is it possible that the HTTP
port was the source of the attach, how would anyone come through an HTTP
port?

BTW the machine that had the open ports and the machine with
mldonkey running were both running Mandrake 9.2, not 10.1 which I
just put on yesterday.

]well, if you pay $40 for a combo firewall/router/dsl device i guess you
]can't expect too much? good enough for home use tho.

You think maybe it is the dollar bills which do the protection? A good
firewall should not be that expensive.
There is no reason it should be.

]keep in mind that you can have 2 Cisco PIX firewalls and 2 linux
]firewalls in front of your server and still be hacked if you dont
]configure your FTP or whatever service correctly. for FTP use vsftpd...
] not alot of parameters to screw up... or read some doco on how to
]setup these services tightly.

Agreed.

I don't normally allow FTP, I opened a port so that a collegue could
download something and I forgot to close it. I'll never open an FTP port
again.