From owner-freebsd-hackers Thu Nov 2 8:39:49 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from mail4.txucom.net (mail4.txucom.net [207.70.175.17]) by hub.freebsd.org (Postfix) with SMTP id 14B5E37B4CF for ; Thu, 2 Nov 2000 08:39:40 -0800 (PST) Received: (qmail 16478 invoked from network); 2 Nov 2000 16:39:36 -0000 Received: from hunt-pri2-a27.txucom.net (HELO user) ([209.34.8.73]) (envelope-sender ) by mail4.txucom.net (qmail-ldap-1.03) with SMTP for ; 2 Nov 2000 16:39:36 -0000 Message-ID: <003c01c044ed$292e1e00$490822d1@user> Reply-To: "Don Muller" From: "Don Muller" To: Subject: Is this how to use Freebsd? Date: Thu, 2 Nov 2000 10:51:30 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0039_01C044BA.DC409640" X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG This is a multi-part message in MIME format. ------=_NextPart_000_0039_01C044BA.DC409640 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, I have some questions that maybe someone could help with. I leased a new server, and redhat 6 .2 was put as the operating system = Shortly after that the machine was hacked. Apparently the machine was a = peach because the hackers used the server to launch DOS attacks from. = The high output hit 44MBS ! Well, the company did not explain how, or why it happened. The = programmer I work with suggested BSD.Of course I wanted security! Well, I told the Network admin that I wanted some security because I = thought the hackers would come back. He said, well, when we put you on a = 10 pipe, (of your 10-100) the attacks stopped, so I don't think they = will come back as they know they are detected. Also, in 98% of the cases they just move on. Well I didn't really think this was all that well thought out, and ripe = for abuse, but what could I do? So I told them to leave the 10mbs pipe = on for a few days in case they come back. Well guess what? They came back! Just a few hours later, and attacked = with the 10 mbs pipe. And it took way longer to detect! Of course. At 44 = mbs they detect it right away. So, when is the network guy gonna do something smart? Well, they gave me some explanation that the server was hacked at the = xfs port. But later I was told that the ftp port on redhat 6.2 was the = vulnerability, so they actually were not sure? They did little to tell = me what to do either, other than to "Clean up". We decided best was to start over rather than look for back doors etc. So this is when we had the network people install Freebsd. And where my = questions lie. Well, They didnt put a smp in the kernal, it was a dual processor. We = fixed that, but the programmer I work with noticed that the files were = not right. We have (2) 9 gig hard drives, and one had 8.3 gigs of space = in /home, The other had 18 mb in / and /var had 19 mb /usr had 7.2 gigs ..... So, we were told that this is a normal out of the box configuration for = Freebsd. Does that make sense? I do not know. But I need to know if my programmer is not really understanding the = files and how they are used in Freebsd, Or if the Network guys made a = mistake, and are thinking we won't catch it. Because...the network guys suggested we try (well at first one guy = agreed and said, yeah, those files and partitions don't look right, I = agree with your programmer) ...so he suggested that we do the following: / 48 mb -- 18 free /var --19 mb /usr -- 7.2 gig drive 2 /home 8.3 mv /usr/* /usr/usr cp / /usr cp /var /usr reload boot software and edit /usr/etc (after copy) to make /usr / -- Well, when our guy logged in and did that it shut his connection down. = The computer just kept looking for a getty file. So his copy probably = messed with the connection when the connection info was moved...or = something I was told by the network guys. Well, I am not a program or a system guy.. But I am thinking that I, or = we are not totally at fault with what happened here,and should not have = to pay for a re install. So, could you comment and expand where possible on the following, it = would be appreciated, and we could then have an idea what to do as well. 1).Does the network have any obligation to lock down a server, before = they hand it over? They have been hit by 10 such attacks since mine and = have changed the strategy to locking the systems down. 2).Does the file and partition system look ok for a 2 drive Freebsd = install? We mainly want to use 1 hd and have one for back up of the = first. 3). Is the following a system that defeats the purpose of Freebsd, or is = not a good way to use it? *Not from programmer Tell them to set up the drives as follows: ___1 paritition per drive___ drive 1 mount to / drive 2 mount to /mnt/backup Ok, well I guess I have confused you enough. Please forward any ideas you may have on teh subject. Thanks D Muller ------=_NextPart_000_0039_01C044BA.DC409640 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hello,
 
I have some questions that maybe someone = could help=20 with.
 
I leased a new server, and redhat 6 .2 was = put as the=20 operating system Shortly after that the machine was hacked. Apparently = the=20 machine was a peach because the hackers used the server to launch DOS = attacks=20 from. The high output hit 44MBS !
 
Well, the company did not explain how, or why = it=20 happened. The programmer I work with  suggested BSD.Of course I = wanted=20 security!
 
Well, I told the Network admin that I wanted = some=20 security because I thought the hackers would come back. He said, well, = when we=20 put you on a 10 pipe, (of your 10-100) the attacks stopped, so I don't = think=20 they will come back as they know they are detected.
Also, in 98% of the cases they just move=20 on.
 
Well I didn't really think this was all that = well=20 thought out, and ripe for abuse, but what could I do? So I told them to = leave=20 the 10mbs pipe on for a few days in case they come back.
 
Well guess what? They came back! Just a few = hours=20 later, and attacked with the 10 mbs pipe. And it took way longer to = detect! Of=20 course. At 44 mbs they detect it right away.
So, when is the network guy gonna do = something=20 smart?
 
Well, they gave me some explanation that the = server was=20 hacked at the xfs port. But later I was told that the ftp port on redhat = 6.2 was=20 the vulnerability, so they actually were not sure? They did little to = tell me=20 what to do either, other than to "Clean up".
 
We decided best was to start over rather than = look for=20 back doors etc.
 
So this is when we had the network people = install=20 Freebsd. And where my questions lie.
 
Well, They didnt put a smp in the kernal, it = was a dual=20 processor. We fixed that, but the programmer I work with noticed that = the files=20 were not right. We have (2) 9 gig hard drives, and one had 8.3 gigs of = space in=20 /home, The other had 18 mb in /   and
/var had 19 mb   /usr had 7.2 gigs=20 .....
 
So, we were told that this is a normal out of = the box=20 configuration for Freebsd. Does that make sense?
 
I do not know.
 
But I need to know if my programmer is not = really=20 understanding the files and how they are used in Freebsd, Or if the = Network guys=20 made a mistake, and are thinking we won't catch it.
 
Because...the network guys suggested we try = (well at=20 first one guy agreed and said, yeah, those files and partitions don't = look=20 right, I agree with your programmer) ...so he suggested that we do the=20 following:
 
/ 48 mb  -- 18 = free
/var  --19=20 mb
/usr -- 7.2 gig


drive 2
/home  8.3

mv=20 /usr/*  /usr/usr
cp / /usr
cp /var /usr

reload boot = software=20 and edit /usr/etc (after copy) to make /usr    = /
--
Well, when our guy logged in and did that it shut his = connection down.=20 The computer just kept looking for a getty file. So his copy probably = messed=20 with the connection when the connection info was moved...or something I = was told=20 by the network guys.
 
 
Well, I am not a program or a system guy.. = But I am=20 thinking that I, or we are not totally at fault with what happened = here,and=20 should not have to pay for a re install.
 
So, could you comment and expand where = possible on the=20 following, it would be appreciated, and we could then have an idea what = to do as=20 well.
 
1).Does the network have any obligation to = lock down a=20 server, before they hand it over? They have been hit by 10 such attacks = since=20 mine and have changed the strategy to locking the systems = down.
 
2).Does the file and partition system look ok = for a 2=20 drive Freebsd install? We mainly want to use 1 hd and have one for back = up of=20 the first.
 
3). Is the following a system that defeats = the purpose=20 of Freebsd, or is not a good way to use it?
 
*Not from programmer
Tell them to set up the drives as = follows:

___1=20 paritition per drive___

drive 1 mount to /

drive 2 mount = to=20 /mnt/backup
 
Ok, well I guess I have = confused you=20 enough.
 
Please forward any ideas you = may have on=20 teh subject.
 
Thanks
 
D Muller
 


 
 
------=_NextPart_000_0039_01C044BA.DC409640-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message