[CentOS] Security advice, please

2009-12-18 Thread Anne Wilson
I run chkrootkit daily. For the first time I've got reports of a problem - Checking `bindshell'... INFECTED (PORTS: 1008) The page http://fatpenguinblog.com/scott-rippee/checking-bindshell-infected- ports-1008/ suggests that this might be a false positive, so I ran 'netstat - tanup' but unlike

Re: [CentOS] Security advice, please

2009-12-18 Thread Rob Kampen
Anne Wilson wrote: I run chkrootkit daily. For the first time I've got reports of a problem - Checking `bindshell'... INFECTED (PORTS: 1008) The page http://fatpenguinblog.com/scott-rippee/checking-bindshell-infected- ports-1008/ suggests that this might be a false positive, so I ran

Re: [CentOS] Security advice, please

2009-12-18 Thread John Doe
From: Anne Wilson cannewil...@googlemail.com I run chkrootkit daily. For the first time I've got reports of a problem - Checking `bindshell'... INFECTED (PORTS: 1008) The page http://fatpenguinblog.com/scott-rippee/checking-bindshell-infected- ports-1008/ suggests that this might be a

Re: [CentOS] Security advice, please

2009-12-18 Thread Anne Wilson
On Friday 18 December 2009 16:55:04 nate wrote: Anne Wilson wrote: do the trick, and I simply didn't know what else to try. In case I meet this again, can you please advise me? Are you doing anything with NFS? If not then turn off the nfs service, and the rpc services

Re: [CentOS] Security advice, please

2009-03-26 Thread Anne Wilson
On Monday 23 March 2009 18:59:51 Steve Huff wrote: On Mar 23, 2009, at 2:37 PM, Anne Wilson wrote: OK - I'm thick. I've looked at that page and seen only what I'm already familiar with. Please, in plain English, how do I set ssh to come in on port 22022 (service called ext-ssh already

Re: [CentOS] Security advice, please

2009-03-23 Thread Anne Wilson
On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote: GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to look for open ports What advantages do they have, in your opinion? there a better way than opening port

Re: [CentOS] Security advice, please

2009-03-23 Thread JohnS
On Mon, 2009-03-23 at 14:31 +, Anne Wilson wrote: On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote: GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to look for open ports What advantages do they

Re: [CentOS] Security advice, please

2009-03-23 Thread Anne Wilson
On Monday 23 March 2009 15:29:53 JohnS wrote: On Mon, 2009-03-23 at 14:31 +, Anne Wilson wrote: On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote: GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to

Re: [CentOS] Security advice, please

2009-03-23 Thread JohnS
On Mon, 2009-03-23 at 16:26 +, Anne Wilson wrote: On Monday 23 March 2009 15:29:53 JohnS wrote: On Mon, 2009-03-23 at 14:31 +, Anne Wilson wrote: On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote: GRC reports that ports are stealthed

Re: [CentOS] Security advice, please

2009-03-23 Thread Anne Wilson
On Monday 23 March 2009 16:57:45 JohnS wrote: On Mon, 2009-03-23 at 16:26 +, Anne Wilson wrote: On Monday 23 March 2009 15:29:53 JohnS wrote: On Mon, 2009-03-23 at 14:31 +, Anne Wilson wrote: On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote:

Re: [CentOS] Security advice, please

2009-03-23 Thread Steve Huff
On Mar 23, 2009, at 2:37 PM, Anne Wilson wrote: OK - I'm thick. I've looked at that page and seen only what I'm already familiar with. Please, in plain English, how do I set ssh to come in on port 22022 (service called ext-ssh already set up for that) to be forwarded to 192.168.0.xx

Re: [CentOS] Security advice, please

2009-03-23 Thread JohnS
On Mon, 2009-03-23 at 18:37 +, Anne Wilson wrote: Her's another example it will do what you want, your just misunderstanding it. I have 2 customers that use Netgear routers. I think your not setting up the Nat - Add Page.

Re: [CentOS] Security advice, please

2009-03-23 Thread Anne Wilson
On Monday 23 March 2009 19:33:58 JohnS wrote: On Mon, 2009-03-23 at 18:37 +, Anne Wilson wrote: Her's another example it will do what you want, your just misunderstanding it. I have 2 customers that use Netgear routers. I think your not setting up the Nat - Add Page.

Re: [CentOS] Security advice, please

2008-12-26 Thread Warren Young
jk...@kinz.org wrote: Hi Warren, Nice explanation. Thanks! I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they know they will have to login from machines they have no control over,

Re: [CentOS] Security advice, please

2008-12-26 Thread Anne Wilson
On Friday 26 December 2008 21:18:27 Warren Young wrote: The other portable is a little Asus Eee 701, reformatted to run Ubuntu Eee.  (Since renamed Easy Peasy...wince...)  I haven't yet got it doing full disk encryption, so I password-protect its ssh key. Since I can't encrypt the whole disk

Re: [CentOS] Security advice, please

2008-12-26 Thread Warren Young
jk...@kinz.org wrote: You are visiting the Otis Public Library in Norwich CT. They have Linux based public workstations (w/Internet access). (http://www.otislibrarynorwich.org/index.htm) Do you trust the library, all of their employees, and every person who has ever used the computer you

Re: [CentOS] Security advice, please

2008-12-25 Thread Lanny Marcus
On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they know they will have to login

Re: [CentOS] Security advice, please

2008-12-25 Thread John R Pierce
Lanny Marcus wrote: On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they

Re: [CentOS] Security advice, please

2008-12-25 Thread Anne Wilson
On Thursday 25 December 2008 11:12:19 Lanny Marcus wrote: On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they

Re: [CentOS] Security advice, please

2008-12-25 Thread Robert Moskowitz
Lanny Marcus wrote: On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they

Re: [CentOS] Security advice, please

2008-12-25 Thread Robert Moskowitz
John R Pierce wrote: Lanny Marcus wrote: On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are

Re: [CentOS] Security advice, please

2008-12-25 Thread Robert Moskowitz
Anne Wilson wrote: On Thursday 25 December 2008 11:12:19 Lanny Marcus wrote: On Wed, Dec 24, 2008 at 12:43 PM, Bill Campbell cen...@celestial.com wrote: snip Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from

Re: [CentOS] Security advice, please

2008-12-25 Thread Frank Cox
On Thu, 25 Dec 2008 09:27:05 -0500 Robert Moskowitz wrote: Once upon a time, MIT had a little red button on their public SUN systems. You pushed the button and got a assured clean boot from their protected server (and I know the people protecting those servers, they were never

Re: [CentOS] Security advice, please

2008-12-24 Thread jkinz
Top posting to ask a question regarding the article below: Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they know they will have to login from machines they

Re: [CentOS] Security advice, please

2008-12-24 Thread Anne Wilson
On Wednesday 24 December 2008 14:30:26 jk...@kinz.org wrote: Top posting to ask a question regarding the article below: Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be

Re: [CentOS] Security advice, please

2008-12-24 Thread Bill Campbell
On Wed, Dec 24, 2008, jk...@kinz.org wrote: Top posting to ask a question regarding the article below: Hi Warren, Nice explanation. I would like to ask what you recommend people do if they want to be able to ssh in from anywhere on the internet. Say they are going to be traveling and they know

Re: [CentOS] Security advice, please

2008-12-24 Thread Anne Wilson
On Wednesday 24 December 2008 17:43:19 Bill Campbell wrote: In summary, I would be extremely reluctant to allow access from public machines where there is no assurance how much malware is running on top of the Microsoft virus, Windows.   When I said that I had used hotel computers I meant for

Re: [CentOS] Security advice, please

2008-12-24 Thread jkinz
On Wed, Dec 24, 2008 at 09:43:19AM -0800, Bill Campbell wrote: On Wed, Dec 24, 2008, jk...@kinz.org wrote: Top posting to ask a question regarding the article below: Summary: Enable ssh to allow login from any random point on the internet I always have my laptop with me, An excellent

Re: [CentOS] Security advice, please

2008-12-24 Thread Bill Campbell
On Wed, Dec 24, 2008, jk...@kinz.org wrote: On Wed, Dec 24, 2008 at 09:43:19AM -0800, Bill Campbell wrote: On Wed, Dec 24, 2008, jk...@kinz.org wrote: Top posting to ask a question regarding the article below: Summary: Enable ssh to allow login from any random point on the internet I

[CentOS] Security advice, please

2008-12-23 Thread Anne Wilson
My LAN is behind a Netgear router, which does NAT. On the CentOS server I have fail2ban running. This morning my router reported 3 different IPs attempting to send UDP packets to port 38950, Since each address is only seen 4-5 times, I presume that fail2ban took over after that. GRC reports

Re: [CentOS] Security advice, please

2008-12-23 Thread John Doe
Then, I want to read from my own IMAP server when I'm away from home. Is there a better way than opening port 143? The easiest would be if you had a fixed external IP and only allow it; but I guess that won't be the case. Maybe using an other port than 143? But I don't think that would fool

Re: [CentOS] Security advice, please

2008-12-23 Thread Michael Simpson
On 12/23/08, Anne Wilson cannewil...@googlemail.com wrote: My LAN is behind a Netgear router, which does NAT. On the CentOS server I have fail2ban running. This morning my router reported 3 different IPs attempting to send UDP packets to port 38950, Since each address is only seen 4-5

Re: [CentOS] Security advice, please

2008-12-23 Thread Kai Schaetzl
Anne Wilson wrote on Tue, 23 Dec 2008 13:06:01 +: My LAN is behind a Netgear router, which does NAT. On the CentOS server I have fail2ban running. This morning my router reported 3 different IPs attempting to send UDP packets to port 38950, which is per se nothing to worry about and

Re: [CentOS] Security advice, please

2008-12-23 Thread Michael A. Peters
John Doe wrote: Then, I want to read from my own IMAP server when I'm away from home. Is there a better way than opening port 143? The easiest would be if you had a fixed external IP and only allow it; but I guess that won't be the case. Maybe using an other port than 143? But I don't

Re: [CentOS] Security advice, please

2008-12-23 Thread Warren Young
Michael Simpson wrote: GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to look for open ports What advantages do they have, in your opinion? there a better way than opening port 143? ssh tunnelling? I agree, though the default CentOS sshd

Re: [CentOS] Security advice, please

2008-12-23 Thread Michael Simpson
On 12/23/08, Warren Young war...@etr-usa.com wrote: Michael Simpson wrote: GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to look for open ports What advantages do they have, in your opinion? they're not grc auditmypc has been mentioned

Re: [CentOS] Security advice, please

2008-12-23 Thread Anne Wilson
On Tuesday 23 December 2008 15:38:17 Warren Young wrote: Michael Simpson wrote: First, thanks to all who replied. I'll try to remember and consider all that has been said. GRC reports that ports are stealthed Try www.auditmypc.com or nmap-online.com rather than grc to look for open