Securite reseau

Bonjour,

Ce n'est pas à proprement parler une question Debian, mais c'est sous
une Debian Etch que ça m'arrive, et il y a certainement des admin réseau
sur la liste

Ce midi, au boot la machine va chercher son adresse ip sur le routeur.
Ok, c'est fait. J'ouvre une session x, lance icewiesel Le site choisi
comme page par défaut ne s'affiche pas. Je tente une requête http sur le
routeur. idem. Le routeur m'est donc inaccessible

J'ai consulté ma messagerie (voir ci-dessous) et puis évidemment
reconfiguré mon interface réseau pour dans un premier temps me connecter
à mon routeur : rien d'anormal.

Je joins, expugés au maximum, les rapports de mes divers "surveillants".
Vous y verrez sans doute des choses que je n'ai pas vu. Malgré tous mes
efforts sur les sites en anglais, je ne parviens pas à me représenter
les procédures à suivre pour palier les failles dénoncées par chkrootkit
et rkhunter. Il ne s'agit pas ici d'un logiciel récalcitrant, mais
peut-être de l'avenir à cout terme de mon réseau familial (4 machines)
et de nos données personnelles et professionnelles, en clair j'ai besoin
d'aide.

Cordialement,
Christophe.



Arpwatch :


hostname: platon.local
ip address: 169.254.214.233
interface: eth0
ethernet address: 0:4f:4e:14:fe:f8
ethernet vendor: <unknown>
timestamp: Monday, November 17, 2008 12:11:26 +0100

Ce qui diffère du message envoyé après son installation

hostname: platon.excathedra.lan
ip address: 192.168.1.103
interface: eth0
ethernet address: 0:4f:4e:14:fe:f8
ethernet vendor: <unknown>
timestamp: Thursday, November 13, 2008 19:01:51 +0100


Logwatch :

################### Logwatch 7.3.1 (09/15/06) ####################
Processing Initiated: Mon Nov 17 12:15:58 2008
Date Range Processed: yesterday
( 2008-Nov-16 )
Period is day.
Detail Level of Output: 5
Type of Output: unformatted
Logfiles for Host: platon
##################################################################

Cron Begin

[]

- Cron End -


dpkg status changes Begin


Installed:
ksh 93r-1

Removed:
firestarter 1.0.3-1.3
winbind 3.0.24-6etch10

Purged:
firestarter 1.0.3-1.3
winbind 3.0.24-6etch10

- dpkg status changes End -


httpd Begin

0.00 MB transferred in 7 responses (1xx 0, 2xx 2, 3xx 2, 4xx 3, 5xx 0)
3 Images (0.00 MB),
4 Content pages (0.00 MB),

Requests with error response codes
404 Not Found
/favicon.ico: 3 Time(s)

- httpd End -


Kernel Begin

[]

- Kernel End -


Named Begin

[]
- Named End -


pam_unix Begin

cron:
[]

gdm:
[]

proftpd:
[]

smbd:
[]

sshd:
Authentication Failures:
unknown (r028.red.fastwebserver.de): 6 Time(s)
unknown (24-182-161-69.dhcp.stls.mo.charter.com): 5 Time(s)
unknown (sd-16247.dedibox.fr): 4 Time(s)
root (89.163.250.121.static.rdns-uclo.net): 2 Time(s)
root (sd-16247.dedibox.fr): 2 Time(s)
unknown (89.163.250.121.static.rdns-uclo.net): 2 Time(s)
bin (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
daemon (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
games (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
lp (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
mail (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
news (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
root (122.200.102.6): 1 Time(s)
root (79.170.216.8): 1 Time(s)
sync (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
unknown (79.99.248.4): 1 Time(s)
uucp (24-182-161-69.dhcp.stls.mo.charter.com): 1 Time(s)
Invalid Users:
Unknown Account: 18 Time(s)

su:
[]
Sessions Opened:
[]
root -> nobody: 3 Time(s)
root -> mixmaster: 1 Time(s)


- pam_unix End -


postfix Begin

[]

- postfix End -


samba Begin

[]

- samba End -


SSHD Begin


SSHD Killed: 1 Time(s)

SSHD Started: 1 Time(s)

Failed logins from:
24.182.161.69: 8 times
bin/password: 1 time
daemon/password: 1 time
games/password: 1 time
lp/password: 1 time
mail/password: 1 time
news/password: 1 time
sync/password: 1 time
uucp/password: 1 time
79.170.216.8: 1 time
root/password: 1 time
88.191.94.148: 2 times
root/password: 2 times
89.163.250.121: 2 times
root/password: 2 times
122.200.102.6: 1 time
root/password: 1 time

Illegal users from:
24.182.161.69: 5 times
adm/password: 1 time
guest/password: 1 time
halt/password: 1 time
operator/password: 1 time
shutdown/password: 1 time
79.99.248.4: 1 time
guest/password: 1 time
88.191.94.148: 4 times
oracle/password: 1 time
pgsql/password: 1 time
postgres/password: 1 time
test/password: 1 time
89.163.250.121: 2 times
mzarza/password: 1 time
trukulo/password: 1 time
217.79.190.28: 6 times
ts/password: 2 times
friedrich/password: 1 time
nagios/password: 1 time
oracle/password: 1 time
teamspeak/password: 1 time

Refused incoming connections:
24-182-161-69.dhcp.stls.mo.charter.com (::ffff:24.182.161.69): 1 Time(s)
89.163.250.121.static.rdns-uclo.net (::ffff:89.163.250.121): 1 Time(s)
r028.red.fastwebserver.de (::ffff:217.79.190.28): 1 Time(s)

- SSHD End -


Disk Space Begin

[]

- Disk Space End -


###################### Logwatch End #########################


chkrootkit :

/etc/cron.daily/chkrootkit:
The following suspicious files and directories were found:
/usr/lib/iceweasel/.autoreg
/usr/lib/xulrunner/.autoreg
/usr/lib/epiphany/2.14/extensions/.pyversion
/lib/init/rw/.ramfs

COMMENTAIRE : ces fichiers sont vides sauf .pyversion (2.4).

/usr/lib/security
/usr/lib/security/classpath.security
INFECTED (PORTS: 1524 6667 31337)
eth0: PACKET SNIFFER(/usr/sbin/snort[2973], /usr/sbin/arpwatch[3105])
/etc/cron.daily/mixmaster:
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/rlist2.txt (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/mlist2.txt (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/pubring.mix (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/rlist.txt (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/mlist.txt (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
/usr/bin/mixmaster-update: Get failed for http://www.noreply.org/echolot/pgp-all.asc (500 Can't connect to www.noreply.org:80 (Bad hostname 'www.noreply.org'))
Exiting eval via next at /usr/bin/mixmaster-update line 384.
Downloading of mlist and/or mixring failed (do you need a proxy?). Aborting.
run-parts: /etc/cron.daily/mixmaster exited with return code 22

COMMENTAIRE : J'ai viré mixmaster

# lsof -i:1524,6667,31337
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
portsentr 3208 root 10u IPv4 9227 TCP *:ingreslock (LISTEN)
portsentr 3208 root 13u IPv4 9233 TCP *:ircd (LISTEN)
portsentr 3208 root 18u IPv4 9243 TCP *:31337 (LISTEN)
portsentr 3212 root 19u IPv4 9309 UDP *:31337

rkhunter:

Scanning for hidden files [ Warning! ]
--

Found warnings:
[12:23:27] WARNING, found: /dev/.static (directory) /dev/.udev (directory) /dev/.initramfs (directory)

--

If you're unsure about the results above, please contact the
Rootkit Hunter team through the Rootkit Hunter mailinglist
at rkhunter-users@lists.sourceforge.net.
Some errors has been found while checking. Please perform a manual check on this machine (platon)


--
Prends donc un coquillage pour parler au noyau.

--
Lisez la FAQ de la liste avant de poser une question :
http://wiki.debian.org/DebFrFrenchLists
Vous pouvez aussi ajouter le mot ``spam'' dans vos champs "From" et
"Reply-To:"

To UNSUBSCRIBE, email to debian-user-french-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org