Very Computer

by **Antti Laukkone** » Tue, 08 May 2001 17:24:05

When i woke up this morning and started to read my logs as usually, i found
5 strange packets, all from different times and source addresses.

Im running on a kernel 2.2.7 with firewall ( Ipchains )

abacus_sentry[591]: attackalert: Unknown packet type from host:
some_ip/some_ip to TCP port: 111
abacus_sentry[591]: attackalert: Packet Flags: SYN: 0 FIN: 0 ACK: 0 PSH: 0
URG: 0 RST: 1
abacus_sentry[591]: attackalert: some_ip has been blocked via wrappers.
abacus_sentry[591]: attackalert: Host some_ip has been blocked via dropped
route.

I have ( atleast i think ) properly configured firewall, denying all
incoming data, how come this packet got through my firewall?

Is there any way to prevent this with ipchains ?

I dont have any servers running, and i checked with tripwire that nothing
was changed / ran chkrootkit ( paranoid? ;) ).

by **Luke Voge** » Tue, 08 May 2001 17:36:44

> When i woke up this morning and started to read my logs as usually, i found
> 5 strange packets, all from different times and source addresses.

> Im running on a kernel 2.2.7 with firewall ( Ipchains )

> abacus_sentry[591]: attackalert: Unknown packet type from host:
> some_ip/some_ip to TCP port: 111
> abacus_sentry[591]: attackalert: Packet Flags: SYN: 0 FIN: 0 ACK: 0 PSH: 0
> URG: 0 RST: 1
> abacus_sentry[591]: attackalert: some_ip has been blocked via wrappers.
> abacus_sentry[591]: attackalert: Host some_ip has been blocked via dropped
> route.

> I have ( atleast i think ) properly configured firewall, denying all
> incoming data, how come this packet got through my firewall?

> Is there any way to prevent this with ipchains ?

> I dont have any servers running, and i checked with tripwire that nothing
> was changed / ran chkrootkit ( paranoid? ;) ).

Looks like you have received a packet looking for a sunrpc port.
Portsentry seens to have stopped further attempts from that ip by using
tcpwrappers, and presumably adding a new rule to your ipchains rule set.

What is not clear, is how the packet got past your firewall script in
the first place.

I'd be willing to bet thta you are running a default policy of accept,
and that even though you have no services running, the packet still got
through and was caught by portsentry.

I'd be checking your ipchains rules to ensure that you are trapping
everything that you dont explicitly want to allow in.

Go to http://www.linux-firewall-tools.com for a design tool that will
make your life easy.

--
Regards
Luke
------
ego.sh comes with a self installer. It is a single threaded multi
process daemon application thats facilitates access to the infamous
game "rat race". Warning uninstalling may enhance system performance.
------
PLEASE NOTE: Spamgard (tm) installed.

------

by **Antti Laukkone** » Tue, 08 May 2001 18:27:07

> > When i woke up this morning and started to read my logs as usually, i
found
> > 5 strange packets, all from different times and source addresses.

> > Im running on a kernel 2.2.7 with firewall ( Ipchains )

> > abacus_sentry[591]: attackalert: Unknown packet type from host:
> > some_ip/some_ip to TCP port: 111
> > abacus_sentry[591]: attackalert: Packet Flags: SYN: 0 FIN: 0 ACK: 0
PSH: 0
> > URG: 0 RST: 1
> > abacus_sentry[591]: attackalert: some_ip has been blocked via wrappers.
> > abacus_sentry[591]: attackalert: Host some_ip has been blocked via
dropped
> > route.

> > I have ( atleast i think ) properly configured firewall, denying all
> > incoming data, how come this packet got through my firewall?

> > Is there any way to prevent this with ipchains ?

> > I dont have any servers running, and i checked with tripwire that
nothing
> > was changed / ran chkrootkit ( paranoid? ;) ).

> Looks like you have received a packet looking for a sunrpc port.
> Portsentry seens to have stopped further attempts from that ip by using
> tcpwrappers, and presumably adding a new rule to your ipchains rule set.
> What is not clear, is how the packet got past your firewall script in
> the first place.

That's what bugs me too :P

Quote:> I'd be willing to bet thta you are running a default policy of accept,
> and that even though you have no services running, the packet still got
> through and was caught by portsentry.

Nope, I have default policy deny and there are no rules to accept any
packets from 'bad hosts'
only from some trusted DNS servers.

Quote:> I'd be checking your ipchains rules to ensure that you are trapping
> everything that you dont explicitly want to allow in.

checked the rules once again, and i didnt find anything what would match to
this.

Quote:> Go to http://www.linux-firewall-tools.com for a design tool that will
> make your life easy.

ok, ill check that out. thanx

by . » Tue, 08 May 2001 19:07:39

Quote:> checked the rules once again, and i didnt find anything what would match
to
> this.

Just to add to the soup, I blocked an IP range from
a host of mine this weekend due to extensive port probes.

route add -net x.x.x.0 netmask 255.255.255.0 reject

Yet portsentry continued to report the probing after I
dropped the route.

??

by **Tim Hayne** » Tue, 08 May 2001 19:58:28

> Just to add to the soup, I blocked an IP range from a host of mine this
> weekend due to extensive port probes.

> route add -net x.x.x.0 netmask 255.255.255.0 reject

> Yet portsentry continued to report the probing after I dropped the route.

Of course it will. They came in through your default route, effectively,
didn't they?

(Never tried setting up a server with the wrong default gateway? People can
send it one SYN packet by all means, but the responses will go down the
spout. All you've done is the same - responses to that block go down the
drain; that doesn't stop them sending you them!)

The solution is: stop logging the blighters.

~Tim
--

Take death on wheels / Re-create the land | http://piglet.is.dreaming.org

by **craw..** » Wed, 09 May 2001 10:53:24

> When i woke up this morning and started to read my logs as usually, i found
> 5 strange packets, all from different times and source addresses.

> Im running on a kernel 2.2.7 with firewall ( Ipchains )

> abacus_sentry[591]: attackalert: Unknown packet type from host:
> some_ip/some_ip to TCP port: 111
> abacus_sentry[591]: attackalert: Packet Flags: SYN: 0 FIN: 0 ACK: 0 PSH: 0
> URG: 0 RST: 1
> abacus_sentry[591]: attackalert: some_ip has been blocked via wrappers.
> abacus_sentry[591]: attackalert: Host some_ip has been blocked via dropped
> route.

> I have ( atleast i think ) properly configured firewall, denying all
> incoming data, how come this packet got through my firewall?

If I read this correctly, then this is a RST packet. some_ip could have
received a spoofed TCP:111 packet with the source IP being your IP. If
this is the case, then you are getting the RST reply from some_ip.

RST packets could be getting passed your firewall? Accepting incoming
non-SYN packets to priveleged ports?

Note that one could perform a "DoS" against your computer by spoofing
your IP; e.g., substitute some_ip with yahoo, cnn, slashdot, etc...

Clyde

Very Computer

Strange packets..

Strange packets..

Strange packets..

Strange packets..

Strange packets..

Strange packets..

Strange packets..