On Tuesday 19 September 2006 08:39, Horst Herb wrote: > > I'm in the throes of applying for level 2 Broadband for Health payment. > > I'm supposed to check my firewall regularly.
further to my last post, a few typical output of the "checking" software I use - if the reports your software sends you are any less you are doing something wrong: (and, PS: of course you should have something like "aide" or "tripwire" running - a database with checksums of all executables on your system that constantly checks all executables whether the checksums still match and notifies you on any mismatch; on Debain again as simple as typing "apt-get install tripwire", and it is installed and will get security updated) ----------------------------------------------------------------------------------------------------- This email is sent by logcheck. If you wish to no-longer receive it, you can either deinstall the logcheck package or modify its configuration file (/etc/logcheck/logcheck.conf). Security Events =-=-=-=-=-=-=-= Sep 18 23:55:52 server1 sshd[8474]: reverse mapping checking getaddrinfo for oratest2.mearkat.net failed - POSSIBLE BREAKIN ATTEMPT! Sep 18 23:55:53 server1 sshd[8478]: reverse mapping checking getaddrinfo for oratest2.mearkat.net failed - POSSIBLE BREAKIN ATTEMPT! Sep 18 23:55:55 server1 sshd[8506]: reverse mapping checking getaddrinfo for oratest2.mearkat.net failed - POSSIBLE BREAKIN ATTEMPT! System Events =-=-=-=-=-=-= Sep 18 23:30:45 server1 sshd[7811]: Illegal user sifak from ::ffff:61.178.127.182 Sep 18 23:30:49 server1 sshd[7817]: Illegal user sifak from ::ffff:61.178.127.182 Sep 18 23:30:50 server1 sshd[7819]: Illegal user sifak from ::ffff:61.178.127.182 Sep 18 23:30:54 server1 sshd[7828]: Illegal user slasher from ::ffff:61.178.127.182 Sep 18 23:30:55 server1 sshd[7825]: Illegal user slasher from ::ffff:61.178.127.182 Sep 18 23:56:37 server1 sshd[8592]: Illegal user administrator from ::ffff:72.3.221.163 Sep 18 23:56:38 server1 sshd[8594]: Illegal user administrator from ::ffff:72.3.221.163 Sep 18 23:56:39 server1 sshd[8596]: Illegal user administrator from ::ffff:72.3.221.163 --------------------------------------------------------------------------------------- fail2ban: persistent attack from 150.101.196.222 --------------------------------------------------------------------------------------- 2006-09-19 02:58:26,795 WARNING: SSH: Unban 200.21.18.136 2006-09-19 07:59:21,102 INFO: SSH: 210.245.184.233 has 5 login failure(s). Banned. 2006-09-19 07:59:21,103 WARNING: SSH: Ban (600 s) 210.245.184.233 2006-09-19 08:09:22,087 WARNING: SSH: Unban 210.245.184.233 2006-09-19 08:53:04,971 INFO: SSH: 150.101.196.222 has 5 login failure(s). Banned. 2006-09-19 08:53:04,971 WARNING: SSH: Ban (600 s) 150.101.196.222 2006-09-19 09:03:05,941 WARNING: SSH: Unban 150.101.196.222 2006-09-19 11:09:48,655 INFO: SSH: 150.101.196.222 has 5 login failure(s). Banned. 2006-09-19 11:09:48,656 WARNING: SSH: Ban (600 s) 150.101.196.222 2006-09-19 11:19:49,632 WARNING: SSH: Unban 150.101.196.222 --------------------------------------------------------------------------------------- chkrootkit output --------------------------------------------------------------------------------------- ROOTDIR is `/' Checking `amd'... not found Checking `basename'... not infected Checking `biff'... not found Checking `chfn'... not infected Checking `chsh'... not infected Checking `cron'... not infected Checking `date'... not infected Checking `du'... not infected Checking `dirname'... not infected Checking `echo'... not infected Checking `egrep'... not infected Checking `env'... not infected Checking `find'... not infected Checking `fingerd'... not found Checking `gpm'... not found Checking `grep'... not infected Checking `hdparm'... not found Checking `su'... not infected Checking `ifconfig'... not infected Checking `inetd'... not infected Checking `inetdconf'... not infected Checking `identd'... not found Checking `init'... not infected Checking `killall'... not infected Checking `ldsopreload'... not infected Checking `login'... not infected Checking `ls'... not infected Checking `lsof'... not found Checking `mail'... not infected Checking `mingetty'... not found Checking `netstat'... not infected Checking `named'... not infected Checking `passwd'... not infected Checking `pidof'... not infected Checking `pop2'... not found Checking `pop3'... not found Checking `ps'... not infected Checking `pstree'... not infected Checking `rpcinfo'... not infected Checking `rlogind'... not found Checking `rshd'... not found Checking `slogin'... not infected Checking `sendmail'... not infected Checking `sshd'... not infected Checking `syslogd'... not infected Checking `tar'... not infected Checking `tcpd'... not infected Checking `tcpdump'... not infected Checking `top'... not infected Checking `telnetd'... not found Checking `timed'... not found Checking `traceroute'... not found Checking `vdir'... not infected Checking `w'... not infected Checking `write'... not infected Checking `aliens'... no suspect files Searching for sniffer's logs, it may take a while... nothing found Searching for HiDrootkit's default dir... nothing found Searching for t0rn's default files and dirs... nothing found Searching for t0rn's v8 defaults... nothing found Searching for Lion Worm default files and dirs... nothing found Searching for RSHA's default files and dir... nothing found Searching for RH-Sharpe's default files... nothing found Searching for Ambient's rootkit (ark) default files and dirs... nothing found Searching for suspicious files and dirs, it may take a while... nothing found Searching for LPD Worm files and dirs... nothing found Searching for Ramen Worm files and dirs... nothing found Searching for Maniac files and dirs... nothing found Searching for RK17 files and dirs... nothing found Searching for Ducoci rootkit... nothing found Searching for Adore Worm... nothing found Searching for ShitC Worm... nothing found Searching for Omega Worm... nothing found Searching for Sadmind/IIS Worm... nothing found Searching for MonKit... nothing found Searching for Showtee... nothing found Searching for OpticKit... nothing found Searching for T.R.K... nothing found Searching for Mithra... nothing found Searching for OBSD rk v1... nothing found Searching for LOC rootkit... nothing found Searching for Romanian rootkit... nothing found Searching for Suckit rootkit... nothing found Searching for Volc rootkit... nothing found Searching for Gold2 rootkit... nothing found Searching for TC2 Worm default files and dirs... nothing found Searching for Anonoying rootkit default files and dirs... nothing found Searching for ZK rootkit default files and dirs... nothing found Searching for ShKit rootkit default files and dirs... nothing found Searching for AjaKit rootkit default files and dirs... nothing found Searching for zaRwT rootkit default files and dirs... nothing found Searching for Madalin rootkit default files... nothing found Searching for anomalies in shell history files... nothing found Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... nothing detected Checking `rexedcs'... not found Checking `sniffer'... lo: not promisc and no packet sniffer sockets eth0: not promisc and no packet sniffer sockets eth0:0: not promisc and no packet sniffer sockets eth0:1: not promisc and no packet sniffer sockets eth0:2: not promisc and no packet sniffer sockets eth0:3: not promisc and no packet sniffer sockets eth0:4: not promisc and no packet sniffer sockets Checking `w55808'... not infected Checking `wted'... nothing deleted Checking `scalper'... not infected Checking `slapper'... not infected Checking `z2'... nothing deleted _______________________________________________ Gpcg_talk mailing list [email protected] http://ozdocit.org/cgi-bin/mailman/listinfo/gpcg_talk
