Skip to Content.
Sympa Menu

baslinux - Re: [BL] HTTPD

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: Stephen Clement <s.clement AT sympatico.ca>
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] HTTPD
  • Date: Wed, 16 Mar 2005 22:29:12 -0500

sindi keesan wrote:

What is the probability of someone else breaking into my computer
even if I am doing everything wrong (running telnetd and httpd,
going online as root, using telnet not ssh, etc.) when I am dialed
into the internet with BL3 or BL2?

If you're dialed in for a minute or so, very small. If you stay connected
for a year, very high.

How about for 2 hours?

I really wouldn't recommend it. Really wouldn't.


Go on for 2 hours every day for a week, and I can almost guarantee that someone
will have at least tested how secure your system is, if not tried to abuse it.

David


How do you know that you are being scanned? Or attacked? Is there some sort of log of attempts?

On my box, there is.


How complicated would it be to run inetd with a list of one permitted login? How many logins does an attacker guess? - I could pick a long login and password. Something more complex than 'user' and enter key, perhaps in extended ASCII (is that possible?).

I probably won't really try this, just curious. BL2 comes set up not to allow root telnet but I disabled that part when I could not manage to even save files as 'user'. I was lucky not to get attacked then.

Indeed, you were lucky not to get attacked.


To give you a good idea of just how bad the situation is, i'll give you some real-world statistics, from my box. I run sshd on my desktop linux computer (BLAG 10000, it's a modern full-blown 1 CD distro). I have an always on Internet connection. ssh connections are allowed from anywhere, and I have root login disabled (but the scanners don't know this!)


I have been scanned approximately 60 times in the past 3 days. I only get attacked about once a week, and the attackers have never been successful. By attacked, I mean mass-guessing passwords, 100+ times. Most scanners give up after 15 guesses or so. Note, this is only info about my SSH server, never mind my FTP server (the latest vsftpd).


Mass guessing the root password? Such as 'enter' and 'root'?
If you are running from CD could they do any permanent damage?

If they could mount your hard disk, yes, they could.

Thanks,

Stephen Clement


So, 60 guesses divided by 72 hours is 0.83. That means, about once per 50 minutes. That's just plain scary. Setting up a telnet server considering how often people get scanned is just crazy. It's your decision.

Thanks,

Stephen Clement
_______________________________________________
BasLinux mailing list
BasLinux AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/baslinux


keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org
_______________________________________________
BasLinux mailing list
BasLinux AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/baslinux






Archive powered by MHonArc 2.6.24.

Top of Page