From owner-freebsd-ports@FreeBSD.ORG Sat Nov 10 20:40:22 2007 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 273CA16A41B for ; Sat, 10 Nov 2007 20:40:22 +0000 (UTC) (envelope-from kris@FreeBSD.org) Received: from weak.local (pointyhat.freebsd.org [IPv6:2001:4f8:fff6::2b]) by mx1.freebsd.org (Postfix) with ESMTP id E6A6913C4BE; Sat, 10 Nov 2007 20:40:20 +0000 (UTC) (envelope-from kris@FreeBSD.org) Message-ID: <47361734.3040406@FreeBSD.org> Date: Sat, 10 Nov 2007 21:40:20 +0100 From: Kris Kennaway User-Agent: Thunderbird 2.0.0.6 (Macintosh/20070728) MIME-Version: 1.0 To: Mike -freebsd References: <84f7f5800711100625l6a0ef442m1a6824fa74c56972@mail.gmail.com> <20071110154407.GA11692@eos.sc1.parodius.com> <4735DC3A.90206@FreeBSD.org> <84f7f5800711100859l454873b2g22925e5defa1149e@mail.gmail.com> In-Reply-To: <84f7f5800711100859l454873b2g22925e5defa1149e@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-ports@freebsd.org Subject: Re: 4203:31337 (possible exploit?) X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Nov 2007 20:40:22 -0000 Mike -freebsd wrote: > On Nov 10, 2007 5:28 PM, Kris Kennaway wrote: > >>> Sounds like you may have a security problem (re: "31337" GID). If >>> that's the case, I would strongly advocate formatting + reinstalling >>> those machines. >> I asked because that is the uid/gid used on pointyhat ;) >> >> Kris >> >> > Well, I've dug up all available backups and what I can tell is that > those uid/gid propagated with the rest of the ports tree from a main > box used here for builds, installations and updates to the whole > network. Stupid me had weekly noid reports disabled on all of them, > except the last one added recently that finally caught it. The problem > was there present for at least three, possibly four months... > > BUT I'm 95% sure that the main ports three was never downloaded via > anything else than c[v]sup + supfile with default host set to eiter > ftp.freebsd.org, or one of the official mirrors, for a past few years. > I wish I could tell you more, but I see nothing even remotely > connected to pointyhat, as there is no point of using any other than > official ports repo for productional machines. OTOH, you wont believe > how glad I was to hear that those are pointyhat IDs.. The "31337" > scared the shit ot of me :( Well the only possibility I can think of is if you installed from a ports.tar.gz downloaded from the FTP site, and extracted with the tar -p option that preserves ownership. Actually that doesn't make sense either because that tarball isn't sourced from pointyhat anyway. In case it jogs any memories, 4203 is the uid used for managing the sparc64 package builds (and gid 31337 is for portmgr ;-). Kris