Date: Thu, 02 Nov 2000 11:11:47 -0500 From: "Moritz Hardt" <mhardt@morix.de> To: "Don Muller" <dmuller@lcc.net>, "freebsd-hackers@FreeBSD.ORG" <freebsd-hackers@FreeBSD.ORG> Subject: Re: Is this how to use Freebsd? Message-ID: <200011021712.SAA16418@post.webmailer.de> In-Reply-To: <003c01c044ed$292e1e00$490822d1@user>
next in thread | previous in thread | raw e-mail | index | archive | help
--_=_=_=IMA.BOUNDARY.HTML_4963392=_=_=_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable It seems to me like, your network administrators are a bit unexperienced= with linux, bsd and system-security. If a machine gets compromised, it should be the first step, to unplug it= from the network and try to analyze who hacked the machine. Since I think you were hacked by standard-script-kiddies, t= hey probably left tracks. so, go thru logfiles, etc. Installing FreeBSD or any other OS is not a garantee for security. You s= hould read the security documentation of the os and it is important to stay up-to-date with your patches. sign up for bu= gtraq@securityfocus.com for example and see if discovered bugs and holes concern your system. there are a lot of things= you can do. I can't listen them all. Now to your mount-problem. First I have to say, that you should use the = FreeBSD-partition/mountpoint-setup during the installation. the step 'mv /usr /usr/usr' is defnetely not understanable, since you me= ss up the whole system. the next steps you did are at least as bad as the first one. your new mount configuration seems really strange to me, aswell. Is it p= ossible that the admin doesn't know much about unix? Anyway, I recommend you to read the FreeBSD-Handbook first, since it exp= lains a lot. You can find it at www.freebsd.org/handbook/ --Original Message Text--- From: Don Muller Date: Thu, 2 Nov 2000 10:51:30 -0600 Hello, =FF I have some questions that maybe someone could help with. =FF I leased a new server, and redhat 6 .2 was put as the operating system S= hortly after that the machine was hacked. Apparently the machine was a peach because the hackers used the server to launch DOS at= tacks from. The high output hit 44MBS ! =FF Well, the company did not explain how, or why it happened. The programme= r I work with=FF suggested BSD.Of course I wanted security! =FF Well, I told the Network admin that I wanted some security because I tho= ught the hackers would come back. He said, well, when we put you on a 10 pipe, (of your 10-100) the attacks stopped, so I= don't think they will come back as they know they are detected. Also, in 98% of the cases they just move on. =FF Well I didn't really think this was all that well thought out, and ripe = for abuse, but what could I do? So I told them to leave the 10mbs pipe on for a few days in case they come back. =FF Well guess what? They came back! Just a few hours later, and attacked wi= th the 10 mbs pipe. And it took way longer to detect! Of course. At 44 mbs they detect it right away. So, when is the network guy gonna do something smart? =FF Well, they gave me some explanation that the server was hacked at the xf= s port. But later I was told that the ftp port on redhat 6.2 was the vulnerability, so they actually were not sure? They did litt= le to tell me what to do either, other than to "Clean up". =FF We decided best was to start over rather than look for back doors etc. =FF So this is when we had the network people install Freebsd. And where my = questions lie. =FF Well, They didnt put a smp in the kernal, it was a dual processor. We fi= xed that, but the programmer I work with noticed that the files were not right. We have (2) 9 gig hard drives, and one had 8.3= gigs of space in /home, The other had 18 mb in /=FF=FF and /var had 19 mb=FF=FF /usr had 7.2 gigs ..... =FF So, we were told that this is a normal out of the box configuration for = Freebsd. Does that make sense? =FF I do not know. =FF But I need to know if my programmer is not really understanding the file= s and how they are used in Freebsd, Or if the Network guys made a mistake, and are thinking we won't catch it. =FF Because...the network guys suggested we try (well at first one guy agree= d and said, yeah, those files and partitions don't look right, I agree with your programmer) ...so he suggested that we do the f= ollowing: =FF / 48 mb=FF -- 18 free /var=FF --19 mb /usr -- 7.2 gig drive 2 /home=FF 8.3 mv /usr/*=FF /usr/usr cp / /usr cp /var /usr reload boot software and edit /usr/etc (after copy) to make /usr=FF=FF=FF= / -- Well, when our guy logged in and did that it shut his connection down. T= he computer just kept looking for a getty file. So his copy probably messed with the conn= ection when the connection info was moved...or something I was told by the network guys.= =FF =FF Well, I am not a program or a system guy.. But I am thinking that I, or = we are not totally at fault with what happened here,and should not have to pay for a re install. =FF So, could you comment and expand where possible on the following, it wou= ld be appreciated, and we could then have an idea what to do as well. =FF 1).Does the network have any obligation to lock down a server, before th= ey hand it over? They have been hit by 10 such attacks since mine and have changed the strategy to locking the systems = down. =FF 2).Does the file and partition system look ok for a 2 drive Freebsd inst= all? We mainly want to use 1 hd and have one for back up of the first. =FF 3). Is the following a system that defeats the purpose of Freebsd, or is= not a good way to use it? =FF *Not from programmer Tell them to set up the drives as follows: ___1 paritition per drive___ drive 1 mount to / drive 2 mount to /mnt/backup =FF Ok, well I guess I have confused you enough. =FF Please forward any ideas you may have on teh subject. =FF Thanks =FF D Muller =FF =FF =FF --_=_=_=IMA.BOUNDARY.HTML_4963392=_=_=_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <HTML> <FONT SIZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans = Serif" DEFAULT=3D"FACE">It seems to me like, your network administrators= are a bit unexperienced with linux, bsd and system-security.<BR> <BR> If a machine gets compromised, it should be the first step, to unplug it= from the network and try to analyze who hacked the machine. Since I thi= nk you were hacked by standard-script-kiddies, they probably left tracks= . so, go thru logfiles, etc.<BR> <BR> Installing FreeBSD or any other OS is not a garantee for security. You s= hould read the security documentation of the os and it is important to s= tay up-to-date with your patches. sign up for bugtraq@securityfocus.com = for example and see if discovered bugs and holes concern your system. th= ere are a lot of things you can do. I can't listen them all.<BR> <BR> Now to your mount-problem. First I have to say, that you should use the = FreeBSD-partition/mountpoint-setup during the installation. <BR> the step 'mv /usr /usr/usr' is defnetely not understanable, since you me= ss up the whole system. the next steps you did are at least as bad as t= he first one. <BR> <BR> your new mount configuration seems really strange to me, aswell. Is it p= ossible that the admin doesn't know much about unix?<BR> <BR> Anyway, I recommend you to read the FreeBSD-Handbook first, since it exp= lains a lot. You can find it at www.freebsd.org/handbook/<BR> <BR> <BR> <BR> --Original Message Text---<BR> <B>From:</B> Don Muller<BR> <B>Date:</B> Thu, 2 Nov 2000 10:51:30 -0600<BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">Hello,<FONT SI= ZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans Serif" D= EFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">I have some questions that maybe someone could h= elp with.<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">I leased a new server, and redhat 6 .2 was put a= s the operating system Shortly after that the machine was hacked. Appare= ntly the machine was a peach because the hackers used the server to laun= ch DOS attacks from. The high output hit 44MBS !<FONT FACE=3D"MS Sans Se= rif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well, the company did not explain how, or why it= happened. The programmer I work with suggested BSD.Of course I wan= ted security!<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well, I told the Network admin that I wanted som= e security because I thought the hackers would come back. He said, well,= when we put you on a 10 pipe, (of your 10-100) the attacks stopped, so = I don't think they will come back as they know they are detected.<FONT F= ACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <FONT FACE=3D"Garamond">Also, in 98% of the cases they just move on.<FON= T FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well I didn't really think this was all that wel= l thought out, and ripe for abuse, but what could I do? So I told them t= o leave the 10mbs pipe on for a few days in case they come back.<FONT FA= CE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well guess what? They came back! Just a few hour= s later, and attacked with the 10 mbs pipe. And it took way longer to de= tect! Of course. At 44 mbs they detect it right away.<FONT FACE=3D"MS Sa= ns Serif" DEFAULT=3D"FACE"><BR> <FONT FACE=3D"Garamond">So, when is the network guy gonna do something s= mart?<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well, they gave me some explanation that the ser= ver was hacked at the xfs port. But later I was told that the ftp port o= n redhat 6.2 was the vulnerability, so they actually were not sure? They= did little to tell me what to do either, other than to "Clean up".<FONT= FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">We decided best was to start over rather than lo= ok for back doors etc.<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR>= <BR> <FONT FACE=3D"Garamond">So this is when we had the network people instal= l Freebsd. And where my questions lie.<FONT FACE=3D"MS Sans Serif" DEFAU= LT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Well, They didnt put a smp in the kernal, it was= a dual processor. We fixed that, but the programmer I work with noticed= that the files were not right. We have (2) 9 gig hard drives, and one h= ad 8.3 gigs of space in /home, The other had 18 mb in / and<F= ONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <FONT FACE=3D"Garamond">/var had 19 mb /usr had 7.2 gigs ....= .<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">So, we were told that this is a normal out of th= e box configuration for Freebsd. Does that make sense?<FONT FACE=3D"MS S= ans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">I do not know.<FONT FACE=3D"MS Sans Serif" DEFAU= LT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">But I need to know if my programmer is not reall= y understanding the files and how they are used in Freebsd, Or if the Ne= twork guys made a mistake, and are thinking we won't catch it.<FONT FACE= =3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">Because...the network guys suggested we try (wel= l at first one guy agreed and said, yeah, those files and partitions don= 't look right, I agree with your programmer) ...so he suggested that we = do the following:<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">/ 48 mb -= - 18 free<BR> /var --19 mb<BR> /usr -- 7.2 gig<BR> <BR> <BR> drive 2<BR> /home 8.3<BR> <BR> mv /usr/* /usr/usr<BR> cp / /usr<BR> cp /var /usr<BR> <BR> reload boot software and edit /usr/etc (after copy) to make /usr &n= bsp; /<BR> --<BR> Well, when our guy logged in and did that it shut his connection down. T= he computer just kept looking for a getty file. So his copy probably mes= sed with the connection when the connection info was moved...or somethin= g I was told by the network guys.<FONT SIZE=3D"1" POINTSIZE=3D"8" DEFAUL= T=3D"SIZE"><FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <BR> <FONT FACE=3D"Garamond">Well, I am not a program or a system guy.. But I= am thinking that I, or we are not totally at fault with what happened h= ere,and should not have to pay for a re install.<FONT FACE=3D"MS Sans Se= rif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">So, could you comment and expand where possible = on the following, it would be appreciated, and we could then have an ide= a what to do as well.<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">1).Does the network have any obligation to lock = down a server, before they hand it over? They have been hit by 10 such a= ttacks since mine and have changed the strategy to locking the systems d= own.<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">2).Does the file and partition system look ok fo= r a 2 drive Freebsd install? We mainly want to use 1 hd and have one for= back up of the first.<FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR>= <BR> <FONT FACE=3D"Garamond">3). Is the following a system that defeats the p= urpose of Freebsd, or is not a good way to use it?<FONT FACE=3D"MS Sans = Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT FACE=3D"Garamond">*Not from programmer<FONT FACE=3D"MS Sans Serif"= DEFAULT=3D"FACE"><BR> <FONT FACE=3D"Garamond">Tell them to set up the drives as follows:<BR> <BR> ___1 paritition per drive___<BR> <BR> drive 1 mount to /<BR> <BR> drive 2 mount to /mnt/backup<BR> <FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">Ok, well I gue= ss I have confused you enough.<FONT SIZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D= "SIZE"><FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">Please forward= any ideas you may have on teh subject.<FONT SIZE=3D"1" POINTSIZE=3D"8" = DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans Serif" DEFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">Thanks<FONT SI= ZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans Serif" D= EFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond">D Muller<FONT = SIZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans Serif"= DEFAULT=3D"FACE"><BR> <BR> <FONT SIZE=3D"3" POINTSIZE=3D"12"><FONT FACE=3D"Garamond"><BR> <BR> <BR> <FONT SIZE=3D"1" POINTSIZE=3D"8" DEFAULT=3D"SIZE"><FONT FACE=3D"MS Sans = Serif" DEFAULT=3D"FACE"> <BR> <BR> <BR> </HTML> --_=_=_=IMA.BOUNDARY.HTML_4963392=_=_=_-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200011021712.SAA16418>