topic suspect string in syslog.log in Operating System - HP-UX

suspect string in syslog.log

Gabriele FACCHINI — Tue, 12 Feb 2002 23:29:28 GMT

hi guys, i found in the syslog this entry:
Feb 12 23:05:54 server1 remshd[15355]: Connection from 0.0.0.0 on illegal port
Feb 12 23:05:56 server1 remshd[15356]: Connection from 0.0.0.0 on illegal port
Feb 12 23:05:59 server1 remshd[15357]: Connection from 0.0.0.0 on illegal port
Feb 12 23:06:05 server1 remshd[15360]: Connection from 0.0.0.0 on illegal port
Feb 12 23:06:17 server1 remshd[15378]: Connection from 0.0.0.0 on illegal port
Feb 12 23:06:42 server1 remshd[15384]: Connection from 0.0.0.0 on illegal port
what this strings means?
thanks a lot for your aid.

Re: suspect string in syslog.log

Michael Tully — Wed, 13 Feb 2002 01:42:21 GMT

Hi,

I am not 100% sure and don't want to
ring the alarm bells too loudly but it
looks as though there has been an
attempted hack into your machine using a
remote shell (remsh). The first thing I
would is (if you can) to close off any
unnecessary ports on your server. Start
with the inetd.conf file and comment out
items like these. Make sure you run
# inetd -c
after making any changes.

login stream tcp nowait root /usr/lbin/rlogind rlogind
shell stream tcp nowait root /usr/lbin/remshd remshd

Did this just start happening or have you
just noticed it?

-Michael

Re: suspect string in syslog.log

harry d brown jr — Wed, 13 Feb 2002 02:36:45 GMT

Gabriele,

As Michael said, shut down what you don't use:

http://people.hp.se/stevesk/bastion.html

Is this server on the internet or within your local network?

live free or die
harry

Re: suspect string in syslog.log

Gabriele FACCHINI — Wed, 13 Feb 2002 06:49:41 GMT

hi guys thanks for your helps.
this server are in internet.
how can i be sure that i have had an attack?
thanks a lot.
gabriele

Re: suspect string in syslog.log

Michael Tully — Wed, 13 Feb 2002 07:05:22 GMT

Hi,

Seeing that you system is on the internet I suggest that you try to make it as robust as possible, by stopping ALL unnecessary services. Also have a look at the link below, it has some interesting information in regards
to hacking.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x71b779bffde7d4118fef0090279cd0f9,00.html

If you haven't already, have a good read of the document link posted by Harry. I have two systems on the net and both were built using this method. To date we haven't been hacked. (touch wood!)

HTH
-Michael

Re: suspect string in syslog.log

Gabriele FACCHINI — Wed, 13 Feb 2002 07:52:08 GMT

thanks for your help.
A ports of remsh is closed by firewall, and this error was created by a failed control of a monitoring system.