Date: Mon, 27 Nov 2000 11:13:38 -0500 From: "Richard Ward" <mh@neonsky.net> To: <freebsd-security@FreeBSD.ORG> Cc: "Peter Pentchev" <roam@orbitel.bg> Subject: Re: *login Message-ID: <000b01c0588d$0138b320$0101a8c0@pavilion> References: <028e01c0586d$fb1c7680$0101a8c0@pavilion> <20001127144953.C420@ringworld.oblivion.bg>
next in thread | previous in thread | raw e-mail | index | archive | help
I saw the login running with the -h option for long periods of times on numerous ip addresses, but not with "high risk" host names (dialup, aol, etc) None of which I can recognize as a regular user's host name, maybe someone who is trying to login with telnet/ssh unsuccessfully? Recently a FreeBSD 4.1.1-STABLE box that I administrate was exploited via the default ports package's named 8.2.3-T5B which according to many I have talked with is not exploitable with the 4.1.1-STABLE release. Since I run bind with userid/groupid "bind", a non-privileged user, the "hacker" was only able to add absurd messages to my named.conf, causing named to fail when reading the conf file and not start back up. I checked www.isc.org's website and found an upgrade from T5B to T6B saying quote "infamous "munnari" bug suite fixed". Could this be the bug that was exploited in my case? Are there any patches or port upgrades to fix an exploitable named 8.2.3-T5B that might be included in T6B? Thanks. -- Richard Ward "sleep deprived and caffeine-empowered" ----- Original Message ----- From: Peter Pentchev <roam@orbitel.bg> To: Richard Ward <mh@neonsky.net> Cc: <freebsd-security@FreeBSD.ORG> Sent: Monday, November 27, 2000 7:49 AM Subject: Re: *login > On Mon, Nov 27, 2000 at 07:31:31AM -0500, Richard Ward wrote: > > Hello, > > I'm wondering what program would use root to execute 'login -h <some weird host> -p". I've noticed every now and then that it would be running as root, and as a regular user, you cannot use the -h option. What exactly could be going on? I only run telnet and ssh1 as remote login daemons. Does telnet or ssh1 require this login command to be executed certain times or randomly? I have both telnet and ssh clients chmod 700, so a regular user won't be able to remotely login from my computer... > > Both /usr/libexec/telnetd and the OpenSSH sshd start login with a -h option. > However, it is next to impossible (or at least very, very improbable) to feed > fake hostnames to either of them - SSH as a whole is notoriously picky as to > DNS-resolving hostnames and such, and I've just checked the telnetd source > in 4.2-STABLE - it accepts no data from the client, but tries to resolve > the hostname both ways using realhostname_sa(3). So, both telnetd and sshd > only record (and pass to login) the real client hostname. > > Have you been seeing actual login processes on your system, running with > a weird -h command-line option, or do you base your judgement on utmp/wtmp > records? If it is utmp/wtmp records, there might be other candidates for > writing bad info there - X terminals come to mind immediately, PAM might > also be involved in some way, and there certainly are other possibilities. > > G'luck, > Peter > > -- > This sentence contradicts itself - or rather - well, no, actually it doesn't! > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?000b01c0588d$0138b320$0101a8c0>