Mike wrote:
> I have discovered recently that my e-smith server for some reason
> is popular for hackers and the likse to try to gain access. While going
> through the /var/log/secure and other logs, I have noticed a lot of
> attempts to gain entry via the FTP server, the qmail server, telnet
> and a few others. here are a few examples
...
> This is just a small sample of the logs, as you can see, I am receiving
> more access attempts
> then what I am comfortable with. What concerned me most is that
> a user somehow managed to log in via 'anonymous' FTP, which I
> thought was not possible except from within the e-smith LAN.
As far as I can tell from the logs your e-smith server is working normally.
The e-smith server ships with an FTP server which allows anonymous FTP access from the Internet.
You haven't shown any telnet connections, and the only POP accesses were refused connection.
The idend daemon connections may be probes, but they are also expected when you connect to SMTP mail transport agents - so the log entries may indicate outgoing mail.
The qmail-smtpd connection looks like a probe, but there are no known vulnerabilities in the qmail mail daemon.
You can disable all of these services very easily by shutting down the inetd daemon. If you want to do something less drastic you will need to
reconfigure inetd. Consult inetd documentation and the e-smith customisation documentation at
http://www.e-smith.org/If you want to disable external HTTP access you will need to change either the access lists or the bind address. Documentation for apache can be found at
www.apache.org.
Feel free to email me if you want to discuss this further.
Regards
Charlie
1 Replies
921 Views