Very Computer

by **Justin Smit** » Fri, 17 Sep 1999 04:00:00

I've posted to this group before about how my Redhat 6.0 system

goes down every few days with dire error messages (like "Aiee ! system panic...).

I ran diagnostics on my machine and it passed all tests. At the same time,

our departmental Sun systems (Ultrasparc servers) slow down to a crawl --- and it

turned out that some hackers are attacking our systems with pings and

telnets (a packet sniffer disclosed that our high-speed network is

completely saturated by pings, ftp's and telnets from a few sources.

The question is: how do I prevent these attacks from crashing my Linux system?

(Disconnecting from the network is not an option...). They slow down Solaris

systems (during the attack itself) but don't kill them off. Our system adminstrator

said that the Linux kernel is full of race conditions that cause it to crash under these circumstances...

Is there some way to reconfigure my system to make it less vulnerable?

My home page: http://www.mcs.drexel.edu/~jsmith

by **YouDontKnowWh** » Fri, 17 Sep 1999 04:00:00

Sounds like you need a firewall REAL BAD. Also, have you looked into
/etc/hosts.allow and /etc/hosts.deny? You can stop many of these
attacks at their very beginning by refusing connects from certain
hosts or domains. The traffic will remain, but you could minimize the
effect of the Telnet and FTP attempts.

You might want to start by completely closing up your Linux server(s)
and then start opening them up a little bit at a time (see the
"Principle of Minimum Access" below). Also, check out the following
two URLs:

1. Setting up a firewall: http://rlz.ne.mediaone.net/linux/ . This
is a really good site. If you need help customizing the firewall
script, post a message here (under the same thread, please!) and I'll
try to help you out.

2. Securing Linux: http://www.securityportal.com/lasg/ . This is
pretty good guide on security for Linux systems. The author used to
have a PDF (Acrobat) version of the guide that you could download from
this site, but he appears to have given up on that (too much of a
hassle). I have a fairly recent copy, which should help you get
going.

Good luck!

--
Principle of Minimum Access: "That which is not explicitly permitted
is denied."

ANNOUNCER: And now we return to our regularly scheduled, uncommonly
entertaining thread...

I've posted to this group before about how my Redhat 6.0 system
goes down every few days with dire error messages (like "Aiee !
system panic...).
I ran diagnostics on my machine and it passed all tests. At the same
time,
our departmental Sun systems (Ultrasparc servers) slow down to a
crawl --- and it
turned out that some hackers are attacking our systems with pings and
telnets (a packet sniffer disclosed that our high-speed network is
completely saturated by pings, ftp's and telnets from a few sources.

The question is: how do I prevent these attacks from crashing my Linux
system?
(Disconnecting from the network is not an option...). They slow down
Solaris
systems (during the attack itself) but don't kill them off. Our system
adminstrator
said that the Linux kernel is full of race conditions that cause it to
crash under these circumstances...

Is there some way to reconfigure my system to make it less vulnerable?

My home page: http://www.mcs.drexel.edu/~jsmith

Very Computer

Attacks bringing my system down!

Attacks bringing my system down!

Attacks bringing my system down!