Very Computer

by **Aaron Lehman** » Sun, 14 Jan 2001 13:24:39

I noticed recently that I was getting ALOT of stuff from 127.0.0.1:>1024
to 127.0.0.1:imap and 127.0.0.1:ssh. Is this some kind of odd
scan/exploit? What would it gain?

I've currently got all localhost stuff DENIED, in case it is, but I
imagine that will play havok with something.... Will it?

Aaron Lehmann

by **Scott Nold** » Sun, 14 Jan 2001 14:14:46

> I noticed recently that I was getting ALOT of stuff from 127.0.0.1:>1024
> to 127.0.0.1:imap and 127.0.0.1:ssh. Is this some kind of odd
> scan/exploit? What would it gain?

> I've currently got all localhost stuff DENIED, in case it is, but I
> imagine that will play havok with something.... Will it?

> Aaron Lehmann

Get yourself a custom built firewall (and check for misspellings) from:
http://www.linux-firewall-tools.com

The author has a book which is an excellent read on IPCHAINS. However,
if you're using kernel-2.4.0+ this will not mean anything to you unless
you compiled in ipchains support.

However, I think you'll find in the ipchains script the means to protect
your box (and us) from spoof attacks and much, much more.

- Scott

--
Never do Windows again with | Scott M. Nolde

glaze! |
12:10am up 1 day, 6:15, 2 users, load average: 1.12, 1.15, 1.09

by **Aaron Lehman** » Sun, 14 Jan 2001 14:24:25

> > I noticed recently that I was getting ALOT of stuff from 127.0.0.1:>1024
> > to 127.0.0.1:imap and 127.0.0.1:ssh. Is this some kind of odd
> > scan/exploit? What would it gain?

> > I've currently got all localhost stuff DENIED, in case it is, but I
> > imagine that will play havok with something.... Will it?

> > Aaron Lehmann

> Get yourself a custom built firewall (and check for misspellings) from:
> http://www.linux-firewall-tools.com

> The author has a book which is an excellent read on IPCHAINS. However,
> if you're using kernel-2.4.0+ this will not mean anything to you unless
> you compiled in ipchains support.

> However, I think you'll find in the ipchains script the means to protect
> your box (and us) from spoof attacks and much, much more.

> - Scott

> --
> Never do Windows again with | Scott M. Nolde

> glaze! |
> 12:10am up 1 day, 6:15, 2 users, load average: 1.12, 1.15, 1.09

I'm using Ipchians... However, I was accepting everything from interface
127.0.0.1, on the assumption that the interface was a hardware thing, and
thus, unspoofable. Evidentally not... Is there anyway that I can set it up
to accept loopback traffic that only COMES from the loopback?

Aaron Lehmann

by **Tim Hayne** » Sun, 14 Jan 2001 20:50:30

[snip]

Quote:> I'm using Ipchians... However, I was accepting everything from interface
> 127.0.0.1, on the assumption that the interface was a hardware thing, and
> thus, unspoofable. Evidentally not... Is there anyway that I can set it up
> to accept loopback traffic that only COMES from the loopback?

These are the necessary and sufficient rules for dealing with loopback:

# ipchains -I input -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
# ipchains -I input -i lo -s 127.0.0.1 -d `hostname` -j ACCEPT -b

Anything else appearing in your drop-through catch-all--deny-and-log rule
is a cause for concern. Try again :8)

~Tim
--

How to get to Sesame Street? |http://piglet.is.dreaming.org

by **Aaron Lehman** » Mon, 15 Jan 2001 00:17:02

> [snip]
> > I'm using Ipchians... However, I was accepting everything from interface
> > 127.0.0.1, on the assumption that the interface was a hardware thing, and
> > thus, unspoofable. Evidentally not... Is there anyway that I can set it up
> > to accept loopback traffic that only COMES from the loopback?

> These are the necessary and sufficient rules for dealing with loopback:

> # ipchains -I input -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> # ipchains -I input -i lo -s 127.0.0.1 -d `hostname` -j ACCEPT -b

Where hostname is my outside address?
Aaron Lehmann

by **elle..** » Mon, 15 Jan 2001 00:41:24

> I noticed recently that I was getting ALOT of stuff from 127.0.0.1:>1024
> to 127.0.0.1:imap and 127.0.0.1:ssh. Is this some kind of odd
> scan/exploit? What would it gain?

Well, do you read local mail via imap or ssh to yourself? ;)

With just those two ports, it looks to me like it may be someone's
.forward or some other bizarre mail scenario. Try checking the mail
and cron logs.

And, to answer your later question, rp_filter should catch any
"imposter" localhost packets by default.

--

by **Tim Hayne** » Mon, 15 Jan 2001 07:34:23

> > These are the necessary and sufficient rules for dealing with loopback:

> > # ipchains -I input -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> > # ipchains -I input -i lo -s 127.0.0.1 -d `hostname` -j ACCEPT -b

> Where hostname is my outside address?

No, `hostname' is a command and `hostname` its output. It's whatever IP#
the resolver returns for your hostname, normally what's located in
/etc/hosts. It's your primary interface address, typically.

~Tim
--
10:31pm up 20 days, 44 min, 13 users, load average: 0.00, 0.02, 0.00

http://piglet.is.dreaming.org |(seen mid-windows 98 installation)

Very Computer

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?

localhost -> localhost?