From owner-freebsd-hackers  Mon Jun 24 01:22:42 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id BAA03713
          for hackers-outgoing; Mon, 24 Jun 1996 01:22:42 -0700 (PDT)
Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id BAA03693;
          Mon, 24 Jun 1996 01:22:33 -0700 (PDT)
Received: by gvr.win.tue.nl (8.6.12/1.53)
    id KAA12148; Mon, 24 Jun 1996 10:22:12 +0200
From: guido@gvr.win.tue.nl (Guido van Rooij)
Message-Id: <199606240822.KAA12148@gvr.win.tue.nl>
Subject: Re: I need help on this one - please help me track this guy down!
To: jkh@time.cdrom.com (Jordan K. Hubbard)
Date: Mon, 24 Jun 1996 10:22:12 +0200 (MET DST)
Cc: hackers@freebsd.org, security@freebsd.org, ache@freebsd.org
In-Reply-To: <10326.835597770@time.cdrom.com> from "Jordan K. Hubbard" at "Jun 23, 96 11:29:30 pm"
X-Mailer: ELM [version 2.4ME+ PL17 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Jordan K. Hubbard wrote:
> > Do you have anti-spoof filter rules in your backbone router? If not
> > install them. If so, please add packets coming in from localhost
> 
> How do you install such things on a cisco 2500? :-) Seriously, if
> there's a way then I can get someone from cisco to help me out, but I
> first need to know that it's even a reasonable request.

Put an access group *in*. On the interface to your ISP. Deny all
packets originating from ip numbers on your internal network. 
Allow anything else.

> 
> > to them. I don't know why he got in, but you can suspect rlogin plus
> > a localhost entry in host.equiv combined with source routed packets.
> 
> Hmmm.  We have reason to believe that he *didn't* get root (though
> we're still assuming he did, just to be paranoid) and if the mod times
> can be trusted, hosts.equiv hasn't been touched in many months (and
> localhost is commented out).

Okay. Than this was not the problem.

-Guido