Re: hacked, then intrusion detection system

2001-02-04 Thread mgriffa
On Sat, 3 Feb 2001, Jonathan D. Proulx wrote: On Sat, Feb 03, 2001 at 08:47:26PM -0300, [EMAIL PROTECTED] wrote: : :It was already a dedicated firewall. The box runs telnetd (only for :192.168.1.x), squid and ipchains. telnetd on a firewall! yes, I know, but is my home network, and I have

Re: hacked, then intrusion detection system

2001-02-04 Thread John Hasler
mgriffa writes: yes, I know, but is my home network, and I have no space for too many monitors... Have you never heard of ssh? -- John Hasler [EMAIL PROTECTED] Dancing Horse Hill Elmwood, Wisconsin

Re: hacked, then intrusion detection system

2001-02-04 Thread mgriffa
On 4 Feb 2001, John Hasler wrote: mgriffa writes: yes, I know, but is my home network, and I have no space for too many monitors... Have you never heard of ssh? Yes, I have to confess. It was a RH firewall, and now I'm migrating my home net to debian, so I dedicated a total of less than

hacked, then intrusion detection system

2001-02-03 Thread mgriffa
Hi. I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs, but the pump package was deleted. I replaced inetd for xinetd. took off services I didnt't use (It was left all default, as I installed in a rush), and now I'd like a good

Re: hacked, then intrusion detection system

2001-02-03 Thread ktb
On Sat, Feb 03, 2001 at 07:02:08PM -0300, [EMAIL PROTECTED] wrote: Hi. I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs, but the pump package was deleted. I replaced inetd for xinetd. took off services I didnt't use (It was

Re: hacked, then intrusion detection system

2001-02-03 Thread John Hasler
mgriffa writes: I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs,... Thereby demonstrating that the author of the script your script-kiddie used is not incompetent. ...but the pump package was deleted. Why do you consider this proof

Re: hacked, then intrusion detection system

2001-02-03 Thread mgriffa
On Sat, 3 Feb 2001, ktb wrote: On Sat, Feb 03, 2001 at 07:02:08PM -0300, [EMAIL PROTECTED] wrote: Hi. I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs, but the pump package was deleted. I replaced inetd for xinetd. took

Re: hacked, then intrusion detection system

2001-02-03 Thread mgriffa
On 3 Feb 2001, John Hasler wrote: mgriffa writes: I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs,... Thereby demonstrating that the author of the script your script-kiddie used is not incompetent. ...but the pump package was

Re: hacked, then intrusion detection system

2001-02-03 Thread Damon Muller
Quoth [EMAIL PROTECTED], I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs, but the pump package was deleted. I replaced inetd for xinetd. took off services I didnt't use (It was left all default, as I installed in a rush),

Re: hacked, then intrusion detection system

2001-02-03 Thread John Hasler
mgriffa writes; is there any way to full re-install the system from inside? like apt-get If the machine has been cracked you cannot trust any executable on it (including the kernel). You can salvage your data and your config files (if you audit them). Fist thing to do is get the machine off

Re: hacked, then intrusion detection system

2001-02-03 Thread Ethan Benson
On Sat, Feb 03, 2001 at 08:47:26PM -0300, [EMAIL PROTECTED] wrote: can I complete re-install with apt? or I have to do the boot from cd again? boot from the CD, and erase all partitions, backup any data or config files you wnat to keep but manually audit each and every file before restoring,

Re: hacked, then intrusion detection system

2001-02-03 Thread Jonathan D. Proulx
On Sat, Feb 03, 2001 at 08:47:26PM -0300, [EMAIL PROTECTED] wrote: : :It was already a dedicated firewall. The box runs telnetd (only for :192.168.1.x), squid and ipchains. telnetd on a firewall! OK, I know you said it only listens on the private net, but it still sound like poor form to me. If

Re: hacked, then intrusion detection system

2001-02-03 Thread Jonathan D. Proulx
On Sat, Feb 03, 2001 at 06:56:01PM -0800, Bill Barnes wrote: : :Take a look at www.coyotelinux.com. :My $50 16M 486 has been up since July 24/7. : :Bill Perhaps you meant to send this to the list? Pretty cool concept for a firewall box, config it, make a spare floppy, if it gets cracked shrug

Re: hacked, then intrusion detection system

2001-02-03 Thread Bill Barnes
Jon: --- Jonathan D. Proulx [EMAIL PROTECTED] wrote: On Sat, Feb 03, 2001 at 06:56:01PM -0800, Bill Barnes wrote: : :Take a look at www.coyotelinux.com. :My $50 16M 486 has been up since July 24/7. : :Bill Perhaps you meant to send this to the list? Yes, thanks for resending it.

Re: hacked, then intrusion detection system

2001-02-03 Thread John Galt
On Sat, 3 Feb 2001 [EMAIL PROTECTED] wrote: Hi. I just realized that someone entered my debian box with cablemodem. I couldn't find anything in the logs, but the pump package was deleted. If you've truly been cracked, of course you can't find anything in the logs. That's one of the first