Re: port to process

Yes, I have been using the "Securiting and Optimizing Linux" Guide to harden
the OS, but unfortunately, it provides you mechanism to make the box secure
and not the ways to detect any break-ins.

Thanks for the info on iptables. I did hear passing mention about them (hey,
i never said I am a full-time linux admin) - I will explore them, figure out
how beneficial is it over ipchains :-)

Thanks,
Manav.
----- Original Message -----
From: "Akshay Guleria" <[email protected]>
To: <[email protected]>
Sent: Wednesday, June 12, 2002 10:19 AM
Subject: Re: port to process


> may be you can follow,
> Securing & optimising red hat linux
> available on linuxdocs.org
>
> I am not sure if its updated but for red Hat 6.2, it was probably the
> best guide.
>
> Also, instead of ipchains, possibly you might consider using iptables.
>
> -Akshay
> PS: I am not GURU but  just a small time linux admin.
>
> On Mon, 2002-06-10 at 15:44, Manavendra Gupta wrote:
> > Pardon me for the late response, but I have been kinda stuck on few
things.
> >
> > OK here we go.
> > # netstat -tap
> > (Not all processes could be identified, non-owned process info
> >  will not be shown, you would have to be root to see it all.)
> > Active Internet connections (servers and established)
> > Proto Recv-Q Send-Q Local Address           Foreign Address
State
> > PID/Program name
> > tcp        0      1 host114.oaz.com:2844    irc2.worldnet.att.:6660
SYN_SENT
> > 155/mech
> > # ps aux |  grep mech
> > # ps aux | grep 155
> > #
> >
> > strings /bin/ps does not anything fishy.
> >
> > Now what?
> >
> > Some history:
> >
> > This box of mine has been under attack, yes attack, from a number of
> > hackers. I was naive and a novice about Linux thrown in the world with
bad
> > boys of Linux. At one point of time, there were three different hackers
in
> > the system - there were two different rootkits being used, buffer
overflows,
> > security exploits using PERL even!
> >
> > I have finally been able to recover. I had to re-install about 9 rpms (I
> > found that ps, pstree, ls, top, vmstat, etc) had been replaced. I now
have:
> > 1. shadow passwords
> > 2. all "r" services disabled.
> > 3. logs monitored using logcheck.
> > 4. ACLs to allow access only to me and couple of boxes from my network
> > 5. MD5 signatures of all rpms stored locally.
> > 6. All suid programs disabled.
> > 7. all un-necessary services disabled.
> > 8. I still have apache and tomcat running as root. I cannot re-install
them
> > in future, but I plan to.
> > 9. ipchains installed and configured.
> > 10. Bastille-linux scripts executed to harden the box more.
> > 11. Connections possible only through SSH.
> >
> > I do NOT, repeat do NOT want to format/rebuild the box - yes, I agree
that
> > the list above is not complete.
> >
> > So,
> > 1. What else do I need to do protect the box?
> > 2. How can I provide you guys with more information? Yes, in my naivette
a
> > lot of information is already lost - due to hasty actions, etc, but if
you
> > point me in the right direction I can provide whatever info you want.
> > 3. What is the best security checklist used by the Gurus out there?
> > 4. Yes, I accept outright I still have a lot to learn. Are there any
online
> > URLs you can point me to?
> >
> > Thanks,
> > Manav.
> > ----- Original Message -----
> > From: "Travis LaWall" <[email protected]>
> > To: <[email protected]>
> > Sent: Sunday, June 09, 2002 1:05 AM
> > Subject: Re: port to process
> >
> >
> > > Manav.
> > >
> > > /sbin/fuser -n tcp 1074,irc2.worldnet.att,6660 to find the process id
of
> > > the application.
> > >
> > > -travis
> > >
> > > Manavendra Gupta wrote:
> > >
> > > >Hi,
> > > >
> > > >when i do a netstat i see the following line:
> > > >
> > > >tcp        0      1 host114.oaz.com:1074    irc2.worldnet.att.:6660
> > SYN_SENT
> > > >
> > > >
> > > >I am sure there are no applications configured to talk to an irc
server.
> > > >
> > > >How do i find the offending application?
> > > >
> > > >Regards,
> > > >Manav.
> > > >
> > > >
> > > >
> > > >
> > > >_______________________________________________
> > > >Redhat-secure-server mailing list
> > > >[email protected]
> > > >https://listman.redhat.com/mailman/listinfo/redhat-secure-server
> > > >
> > > >.
> > > >
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > Redhat-secure-server mailing list
> > > [email protected]
> > > https://listman.redhat.com/mailman/listinfo/redhat-secure-server
> > >
> >
> >
> >
> > _______________________________________________
> > Redhat-secure-server mailing list
> > [email protected]
> > https://listman.redhat.com/mailman/listinfo/redhat-secure-server
> >
>
>
>
> _______________________________________________
> Redhat-secure-server mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/redhat-secure-server
>