[96704] in RedHat Linux List
I think I've been hacked
daemon@ATHENA.MIT.EDU (Robert W. Canary)
Wed Oct 28 21:50:32 1998
Date: Wed, 28 Oct 1998 21:38:17 -0600
From: "Robert W. Canary" <rwcanary@ohiocounty.net>
Reply-To: rwcanary@mail.lig.bellsouth.net
To: redhat-list@redhat.com
Resent-From: redhat-list@redhat.com
Hi,
About four days ago I started getting Protocol-Reject for unsupported
protocol 0x808 in my log files every time one of my users logged on.
This was happening at such a fast rate that the system logger was
loading down the system.
Looking back into the logfiles I found a number of attempts by someone
to log onto the system. Immediately after that is when the strange
protocol errors starting to appear. Here is an extract of the log
file, can anyone make sense out of this.
Oct 24 12:25:49 office mgetty[12126]: data dev=ttyC0, pid=12126,
caller='none', conn='57600', name='', cmd='/bin/login', user='~}#@!}!}&}
}6}!}$}%r}"}&} }*} } }
Oct 24 12:29:53 office named[330]: Cleaned cache of 100 RRs
Oct 24 12:29:53 office named[330]: listening on [192.168.1.100].53
(ppp2)
Oct 24 12:29:53 office named[330]: USAGE 909250193 907860590
CPU=14.89u/11.43s CHILDCPU=0u/0s
Oct 24 12:29:53 office named[330]: NSTATS 909250193 907860590 A=14386
PTR=2464 MX=924 TXT=1 ANY=1625
Oct 24 12:29:53 office named[330]: XSTATS 909250193 907860590 RR=18645
RNXD=582 RFwdR=14053 RDupR=148 RFail=23 RFErr=0 RErr=1 RAXFR=0 RLame=509
ROpts=0 SSysQ=23
Oct 24 12:31:51 office mgetty[12136]: data dev=ttyC0, pid=12136,
caller='none', conn='57600', name='', cmd='/usr/local/lib/fnet/ifcico',
user='yoohoo'
Oct 24 12:31:51 office mgetty[12136]: cannot execute
'/usr/local/lib/fnet/ifcico': No such file or directory
Oct 24 12:34:24 office mgetty[12162]: data dev=ttyC0, pid=12162,
caller='none', conn='57600', name='', cmd='/usr/local/lib/fnet/ifcico',
user='tsync'
Oct 24 12:34:24 office mgetty[12162]: cannot execute
'/usr/local/lib/fnet/ifcico': No such file or directory
Oct 24 12:51:38 office mgetty[12198]: data dev=ttyC0, pid=12198,
caller='none', conn='57600', name='', cmd='/bin/login', user='~}#@!}!}&}
}6}!}$}%r}"}&} }*} } }
Oct 24 12:51:38 office PAM_pwdb[12198]: bad username [~}#@!}!}&}
}6}!}$}%r}"}&} }*} } }%}&(},gM}(}".g~PgA]
Oct 24 12:51:38 office login[12198]: FAILED LOGIN 1 FROM (null) FOR
~}#@!}!}&} }6}!}$}%r}"}&} }*} } }%}&(},gM}(}".g~PgA, User not known to
the underlying authen
Oct 24 12:58:01 office mgetty[12508]: data dev=ttyC0, pid=12508,
caller='none', conn='57600', name='', cmd='/usr/sbin/pppd',
user='/AutoPPP/'
Oct 24 12:58:02 office pppd[12508]: pppd 2.3.3 started by LOGIN, uid 0
Oct 24 12:58:02 office pppd[12508]: Using interface ppp1
Oct 24 12:58:02 office pppd[12508]: Connect: ppp1 <--> /dev/ttyC0
Oct 24 12:58:02 office pppd[12508]: sent [LCP ConfReq id=0x1 <asyncmap
0x0> <auth pap> <magic 0x3dd9> <pcomp> <accomp>]
Oct 24 12:58:02 office pppd[12508]: rcvd [LCP ConfAck id=0x1 <asyncmap
0x0> <auth pap> <magic 0x3dd9> <pcomp> <accomp>]
Oct 24 12:58:04 office pppd[12508]: rcvd [LCP ConfReq id=0x3 <asyncmap
0xa0000> <magic 0x2379e> <pcomp> <accomp> <callback 0x602>]
Oct 24 12:58:04 office pppd[12508]: sent [LCP ConfRej id=0x3 <callback
0x600>]
Oct 24 12:58:05 office pppd[12508]: rcvd [LCP ConfReq id=0x4 <asyncmap
0xa0000> <magic 0x2379e> <pcomp> <accomp>]
Oct 24 12:58:05 office pppd[12508]: sent [LCP ConfAck id=0x4 <asyncmap
0xa0000> <magic 0x2379e> <pcomp> <accomp>]
Oct 24 12:58:05 office PAM_pwdb[12508]: (ppp) session opened for user
slmay by (uid=0)
Oct 24 12:58:05 office pppd[12508]: user slmay logged in
Oct 24 12:58:05 office pppd[12508]: sent [PAP AuthAck id=0x1 "Success"]
Oct 24 12:58:05 office pppd[12508]: sent [IPCP ConfReq id=0x1 <addr
192.168.1.100> <compress VJ 0f 01>]
Oct 24 12:58:05 office pppd[12508]: rcvd [IPCP ConfReq id=0x1 <compress
VJ 0f 01> <addr 0.0.0.0> <dns-addr 0.0.0.0> <wins-addr 0.0.0.0>
<dns-addr 0.0.0.0> < 84
Oct 24 12:58:05 office pppd[12508]: sent [IPCP ConfRej id=0x1 <wins-addr
0.0.0.0> < 84 06 00 00 00 00>]
Oct 24 12:58:05 office pppd[12508]: rcvd [CCP ConfReq id=0x1 < 12 06 00
00 00 01> < 11 05 00 01 04>]
Oct 24 12:58:05 office pppd[12508]: sent [CCP ConfReq id=0x1]
Oct 24 12:58:05 office pppd[12508]: sent [CCP ConfRej id=0x1 < 12 06 00
00 00 01> < 11 05 00 01 04>]
Oct 24 12:58:05 office pppd[12508]: rcvd [IPCP ConfAck id=0x1 <addr
192.168.1.100> <compress VJ 0f 01>]
Oct 24 12:58:05 office pppd[12508]: rcvd [IPCP ConfReq id=0x2 <compress
VJ 0f 01> <addr 0.0.0.0> <dns-addr 0.0.0.0> <dns-addr 0.0.0.0>]
Oct 24 12:58:05 office pppd[12508]: sent [IPCP ConfNak id=0x2 <addr
192.168.1.101> <dns-addr 192.168.1.1> <dns-addr 205.152.0.5>]
Oct 24 12:58:05 office pppd[12508]: rcvd [CCP ConfAck id=0x1]
Oct 24 12:58:05 office pppd[12508]: rcvd [IPCP ConfReq id=0x3 <compress
VJ 0f 01> <addr 192.168.1.101> <dns-addr 192.168.1.1> <dns-addr
205.152.0.5>]
Oct 24 12:58:05 office pppd[12508]: sent [IPCP ConfAck id=0x3 <compress
VJ 0f 01> <addr 192.168.1.101> <dns-addr 192.168.1.1> <dns-addr
205.152.0.5>]
Oct 24 12:58:06 office pppd[12508]: found interface eth0 for proxy arp
Oct 24 12:58:06 office pppd[12508]: local IP address 192.168.1.100
Oct 24 12:58:06 office pppd[12508]: remote IP address 192.168.1.101
Oct 24 12:58:06 office ip-auth-up[12661:12508]: ppp1 slmay root
/dev/ttyC0 57600
Oct 24 12:58:06 office ip-up[12667:12508]: ppp1 /dev/ttyC0 57600
192.168.1.100 192.168.1.101
Oct 24 12:58:08 office pppd[12508]: rcvd [CCP ConfReq id=0x2]
Oct 24 12:58:08 office pppd[12508]: sent [CCP ConfAck id=0x2]
Oct 24 12:58:08 office pppd[12508]: rcvd [CCP TermReq id=0x3]
Oct 24 12:58:08 office pppd[12508]: CCP terminated by peer
Oct 24 12:58:08 office pppd[12508]: sent [CCP TermAck id=0x3]
Oct 24 12:58:08 office pppd[12508]: Compression disabled by peer.
Oct 24 12:58:13 office pppd[12508]: rcvd [LCP ProtRej id=0x5 08 08 08 08
08 7c]
Oct 24 12:58:13 office pppd[12508]: Protocol-Reject for unsupported
protocol 0x808
Oct 24 12:58:14 office pppd[12508]: rcvd [LCP ProtRej id=0x6 08 08 08 08
08 2f 20 20 20 20]
Oct 24 12:58:14 office pppd[12508]: Protocol-Reject for unsupported
protocol 0x808
I really appreciate the help :-)
--
robert
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
