Date: Thu, 30 Nov 1995 00:00:50 -0800 From: "Jordan K. Hubbard" <jkh@time.cdrom.com> To: Robert Du Gaue <rdugaue@calweb.com> Cc: security@freebsd.org Subject: Re: ****HELP***** Message-ID: <8119.817718450@time.cdrom.com> In-Reply-To: Your message of "Wed, 29 Nov 1995 21:21:28 PST." <Pine.BSF.3.91.951129211638.7134A-100000@web3.calweb.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hmmmmmm. A couple of things that confuse me here.. You say you "upgraded" sendmail 8.9 to 8.7? :) I can ask around, but I wasn't aware of anything too pathologically wrong with either version. Second, I assume you've deleted the account of the person being attacked? I'm curious how he got ahold of the real password file - are you sure it wasn't just the shadow passwords? If you can give us more clues, we can both give you avenues to follow in securing your system and track down the method(s) the perp is using. Also, please don't be afraid to employ legal means. What this hacker has done is a felony and and should be made an example of to the fullest extent provided by the law. Most data crime units in the various PDs are fairly eager, actually - it's budget time! :-) Also, the security@freebsd.org list is available for discussing security issues with other admins throughout the world, many of whom are pretty good. I'm sure at least one or two people here will have some first tips for you to try (security isn't really my bag, to be honest!). Anyway, I'd be happy to help you out, but we obviously need more information about what this guy is actually up to.. Any log info or anything else you think may be relevant? Thanks. Jordan > Well, we've got a major problem I'm hoping you can solve. Yesterday a > user (know pirate) pissed off another hacker and somehow he got into the > system and deleted the users directory, took our pw file (cated out in an > IRC channel with the encrypted pws). We immediately check our systems, > found sendmail to be 8.9, upgraded all these sendmails to 8.7, blocked 2 > class addresses that he may have came from, removed root from ftp on one > of the machines, and deleted all the lp stuff (since we have no printers). > > Checked for suid programs. Well, we restored the directory, and it got > deleted again tonight. We have no idea how he is doing this. He's changed > a the /etc/raddb/users file (removed the user from the file) also. In a > word, I'm stuck, we're unsure of how he's doing it and I'm very scared > right now that he'll do something major to the system.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8119.817718450>