Re: [expert] The lights are on, but no one's home

[Daniel Baker]

Try This:

ping your server ip -f

Whats your lights do now?

Dan.

- Original Message -
From: Bob Puff@NLE [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, August 31, 2000 11:11 PM
Subject: [expert] The lights are on, but no one's home


 Hello,

 Tonight, I was watching the lights on the switch I have connecting my DSL
line to
 my servers, and saw a prolonged, intensive activity to one of my machines
that is
 a web server, amongst other things.  During this activity, I telnetted in,
and took
 a peek at the logs to see just what was going on.

 Running Apache, but no html access logged within the past few hours
 Running ftp, but no ftp access either within the past few hours
 Running Postfix, but once again, nothing -current-.
 Running RealServer, but I looked at its log, nothing recorded in there
that was current.
 Nothing in MESSAGES, AUTH.LOG, MAIL.LOG, SECURE, XFERLOG that was recent.

 I am not running a nameserver on this machine.  Running the basic stock
services that
 Mandrake 7.1 sets up.

 Where should I look for more info?

 Is there a package that perhaps comes with 7.1 that is a monitoring
program that I
 could access via my browser?

 Bob

RE: [expert] The lights are on, but no one's home

[Tony Smith]

 Tonight, I was watching the lights on the switch I have
 connecting my DSL line to
 my servers, and saw a prolonged, intensive activity to one of my
 machines that is
 a web server, amongst other things.  During this activity, I
 telnetted in, and took
 a peek at the logs to see just what was going on.

 Running Apache, but no html access logged within the past few hours
 Running ftp, but no ftp access either within the past few hours
 Running Postfix, but once again, nothing -current-.
 Running RealServer, but I looked at its log, nothing recorded in
 there that was current.
 Nothing in MESSAGES, AUTH.LOG, MAIL.LOG, SECURE, XFERLOG that was recent.

 I am not running a nameserver on this machine.  Running the basic
 stock services that
 Mandrake 7.1 sets up.

It may have been a portscan. If you're running all the standard services
that LM7.1 sets up, then you're probably quite exposed. Cut back to the bare
minimum and make sure that insecure services like telnet etc. are not
accessible via the DSL link.

I couldn't find any docs on this, but in /etc/inetd.conf you can restrict
the interfaces on which inetd services will run by using a syntax like this:

localhost@telnetstream  tcp nowait  root/usr/sbin/tcpd
in.telnetd
myhost@telnet   stream  tcp nowait  root/usr/sbin/tcpd
in.telnetd

This will allow telnet access only when connecting to the loopback address,
or to the ip address that myhost resolves to (not your DSL address!).

If you haven't got some good ipchains rules in place, that should be your
next stop. ipchains can be configured so that it will log any offending
packets, and I use Psionic logcheck (http://www.psionic.com) to keep me
appraised of all interesting events in my log files.

Tony