[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Detecting break-ins

On Tue, Jan 15, 2002 at 09:04:07PM +0100, Balazs Javor wrote:
> Then there are more exotic stuff. High port UDP attampts,
> connection to port 113 etc.

High port UDP stuff is often just traceroutes.  113 is normal, as many
servers will attempt an auth lookup when you access them.

> Now the logs provided by the above packages often say something
> like 'connection attempt to ..' whichever port/service.
> The question is whether there is a way to know whether any of those
> attempts succeded. Or to put it more simply, how could one
> distinguish a failed attempt and a successful break-in?

Well, the first thing to as is "is there anything even listening on that
port?"  You can feel pretty safe about (for example) connection attempts
to your telnet daemon if you're not actually running a telling daemon to
begin with.

You should already have a pretty good idea about what services are
listening on various ports on your machine.  But just to be sure, try
running 'netstat -ulp' and 'netstat -tlp' as root to show which PIDs are
listening on which UDP and TCP ports, respectively.  Turn off what you
don't need by removing its entry from inetd.conf or by prevending init
from starting it from /etc/rc?.d

> (I know this is probably a very complex topic, but I would
> greatly appreciate some advise!)

Most of stuff that you see, really, is harmless.  A lot of it, as I said
above, isn't even necessarily a breakin attempt.  Assuming you're up to
date on the fixes from security.debian.org, you're safe from the worms
and script kiddies, which are the only things stupid enough to do
something that will show up in your logs.  

It's always good to set up a host based intrusion detection system like
tripwire (preferably the version in sid, rather than the ancient slow
version from potato).  And look in to something like LIDS or something
else that can verify the integrity of the in-memory kernel image.
Kernel based rootkits are very hard to detect.


| Web: http://web.morgul.net/~frodo/
| PGP Public Key: http://web.morgul.net/~frodo/mail.html 

Attachment: pgpq7JsIOE_ik.pgp
Description: PGP signature

Reply to: