Re: Hacked - is it my turn?
On 2004.02.02 21:08, Johannes Graumann wrote:
Hello,
Checksecurity reports this:
> Security Violations for su
> =-=-=-=-=-=-=-=-=-=-=-=-=-
> Feb 2 06:33:11 server_name su[16863]: + ??? root:nobody
'tiger' also reports - while performing signature check of system
binaries, that /bin/ping, /usr/bin/chage, /usr/bin/at, /usr/bin/write
and /usr/bin/inetd don not match. This can not be confirmed by aide
(cd-burned database, unsafe binary) or debsums (unsafe binary).
Hi,
have something similar here:
# Performing signature check of system binaries...
NEW: --WARN-- [sig004w] None of the following versions of /bin/ping
(-rwsr-xr-x) matched the /bin/ping on this machine.
NEW: --WARN-- [sig004w] None of the following versions of /usr/bin/at
(-rwsr-xr-x) matched the /usr/bin/at on this machine.
NEW: --WARN-- [sig004w] None of the following versions of /usr/sbin/
inetd
(-rwxr-xr-x) matched the /usr/sbin/inetd on this machine.
# Checking for correct umask settings...
# Performing common access checks for root...
Considerung this kind of behavior is on two machines now makes me
assume this might be another bug with tiger. :-)
BTW, the machine logging this has sid installed.
Moreover, I got these messages:
# Performing check of 'services' ...
OLD: --FAIL-- [inet002f] Service binkp is assigned to port 24554/tcp
which
should be 24554/udp.
OLD: --FAIL-- [inet002f] Service fido is assigned to port 60179/tcp
which
should be 60179/udp.
OLD: --FAIL-- [inet002f] Service ircd is assigned to port 6667/tcp
which should
be 6667/udp.
OLD: --FAIL-- [inet002f] Service tfido is assigned to port 60177/tcp
which
should be 60177/udp.
OLD: --FAIL-- [inet002f] Service tproxy is assigned to port 8081/tcp
which
should be 8081/udp.
OLD: --FAIL-- [inet002f] Service webcache is assigned to port 8080/tcp
which
should be 8080/udp.
Is that anything to be worried about? After all, it's just some
mappings in /etc/services, or is it? I don't run an ircd (I know of),
for instance, and the other ports mentioned here are not shown as open
by nmap/netstat.
Best regards,
Andreas
Reply to: