Home | Gallery | Forum | Services | Webmail | Archive | Links | Contact Us | About Us
OS2 World.Com Forum
OS2 World.Com Online Discussion Forum.
Index / OS/2 - General / Networking
author message
"hackers" and OS/2
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
1. "hackers" and OS/2
Reply to this topic with quote Modify your message
Well, I got a good dose of a hacker this weekend going against my box... and was wondering if there are good tools to track them down or keep them out without pulling everything down.

My web server kept failing for each of their attempts (good thing) but still makes me worried. I got a firewall on my router as well, but wondering if I need something else..

Any ideas?

petpipe[at]satx[dot]rr[dot]com

Date: 23 Sep, 2002 on 19:54
Kim
Team member
in staff

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.haverblad.se
posts: 2128
since: 10 Dec, 2000
2. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
Guess that your router have the feature of keeping an access log, or? If so you can check out if someone has made any port scans etc along with the Apache log (or what ever web server you're using) you can also check for try outs for root kit installations or any other virus that have tried to attack your system. From checking aboce logs I usually make a fast compare to see if I can find any pattern of IP that have made heavy attempts of crashing my systems (here at home). When I narrowed down some IP I usually check with RIPE (www.ripe.net) to figure out who owns the IP#. And sends them an abuse repport.

Ok, above was the repporting part. Regarding tools for OS2, well you can always config the tcpip stack to ignore ports or ban IP numbers. I'm using a D-Link 704 ADSL router and it takes care of the most trouble for me so nothing much gets through. If you really want to keep more "control" on what going in and out I would say that you should set up either a FW before your other systems, define a DMZ for public access etc. I would suggest either freesco or freebsd as FW OS.

But, how big of a problem is it for you? Crashing system everyday? What sort of router/fw do you currently have today?

/Kim

Date: 23 Sep, 2002 on 20:28
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
3. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
I didn't want to give to much specifics at first, but I got:

WSeB and Domino Web
Linksys router with port 80 going to this machine..

I noticed in my Domino logs (error and extended trace logs) they were trying to attach or find: root.exe and or cmd.exe in either my cgi bin or my winnt/system32 folder/drive (CGI has some flaws that I've been reading on the net).

All the times unsuccessful...noticed I was getting ton of incoming traffic to FTP port and that is blocked on the router... and wondering about DoS .

Thanks for the other abuse link.. because I can do a trace route on them and find them, assuming they aren't behind a firewall/router.

Date: 23 Sep, 2002 on 20:44
Kim
Team member
in staff

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.haverblad.se
posts: 2128
since: 10 Dec, 2000
4. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message

pipes (Sep 23, 2002 22:44):
WSeB and Domino Web
Linksys router with port 80 going to this machine..

Well,. above should block the most of the unwanted traffic to your system. Just wondering about the Domino, what version are you using? Since I set up a Domino myself so might be some other questions around that. But, guess that we can keep that out if this thread


I noticed in my Domino logs (error and extended trace logs) they were trying to attach or find: root.exe and or cmd.exe in either my cgi bin or my winnt/system32 folder/drive (CGI has some flaws that I've been reading on the net).

Well, this only way I guess that you could get ride of above is by using any sort of proxy filtering software such as Squid. I haven't tried but, guess that Squid should be able to remove such request by defining what request that sgould be deleted. Hmm. guess that I should check it myself; might get handy Above request are usually made be Windows based virus or rootkit applications. But, are you like getting thousands of request per day, or?


FTP port and that is blocked on the router... and wondering about DoS.

DoS attacks are hard to prevent and hard to avoid for home users. In your case and my own for that matter the router would go down (hang) first. That has happened to me once. The log file etc on the router was gone since I had to hard restart it. Here it would be nice to have tool to download the logfile every day to keep them "offline" from the router.

/Kim

Date: 23 Sep, 2002 on 21:45
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
5. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
When I get home, I will post some of the crazy logs, they are trying to bind to cmd.exe and root.exe ... Looks like they are trying pretty good...

I will need some help with setting up ACL in Domino, since it fails for me...

At one point, I tinkered so much that my Admin config page was not secured, so I brought it all down and removed/reinstalled... was not pretty!

Date: 23 Sep, 2002 on 22:04
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
6. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
I went with Go Web Server for OS/2 instead of Domino... damn ACL..

Too bad it isn't as easy as MS IIS for manageability, but I rather have the strict use of pure HTTP instead..

Date: 08 Oct, 2002 on 20:11
Kim
Team member
in staff

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.haverblad.se
posts: 2128
since: 10 Dec, 2000
7. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
if you're just looking for a plain web server why not use Apache?
Date: 09 Oct, 2002 on 14:45
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
8. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
I guess I could, but just not to familiar with it, enough to be protected...

I have been one day with GoServ and so far soo good. I ditched Domino... a while back.

Date: 09 Oct, 2002 on 23:51
pipes
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 35
since: 17 Aug, 2001
9. Re:"hackers" and OS/2
Reply to this topic with quote Modify your message
I just noticed a while back that GoServe goes into port 80 then out any random port... I assume this is for threading.. I freaked the first time I saw this...
Date: 17 Oct, 2002 on 23:26
"hackers" and OS/2
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
All times are CET+1. < Prev. | P. 1 | Next >
Go to:
 

Powered by UltraBoard 2000 Standard Edition,
Copyright © UltraScripts.com, Inc. 1999-2000.
Home | Gallery | Forums | Services | Webmail | Archive | Links | Contact Us | About Us
OS2 World.Com 2000-2004