serious security issue!

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

I've been running samba for a couple of weeks (well at least I got my print share working) but I just checked my /var/log/samba/ directory and I found some disturbing stuff. There is a list of computers that have accessed the server, and most of them are not on my network! Someone please tell me if I'm interpreting this wrong.

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

by the way, all of those logs are full of errors, which makes me think they didn't get in,(i'm sure if they were skillful enough to get in they would have erased the logs) but still, its pretty scary.

ekoontz · Posted: Thu Dec 04, 2003 9:21 am Post subject:

Hi mlsfit,

In my /etc/samba/smb.conf I have :

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

here are the contents of ramonahouse.log (not on my network but suspiciously familiar)

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

your host allow line has two partial addresses:

192.168.0.
127.

Does that mean that any computer with an ip that starts w/ 192.168.0 or 127. will be have access? Every Address on my lan starts with 192.168.1, so if I used that partial address, it should work for me right?

Boris27 · Posted: Thu Dec 04, 2003 9:56 am Post subject:

fleed · l33t Joined: 28 Aug 2002 Posts: 756 Location: London

You could also set up iptables to block the smb ports so you won't even get that in your samba logs + the crackers won't know if you have smb on or not.

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

supposing that some inexperienced hacker did manage to get into my computer, where else would I find evidence of this? I'm a little paranoid now, because whoever was trying to access samba seemed to know a little bit about me (once again ramonahouse is a significant name for me, Its actually the name of one of the sober living homes that I operate).

For some reason I can't have netfilter, and 3d support at the same time. Maybe the new kernel would allow this, but in the mean time, I'm blocking all incoming connection requests via my hardware router!

fleed · l33t Joined: 28 Aug 2002 Posts: 756 Location: London

Could there be any way in which ramonahouse is associated with your ip address? Do you use that name in a forum, for example? Do you have a website for it on your pc? Have you tried googling it together with your ip address to see what comes up? Have a look at the ip address where the request from ramonahouse came from so you see if there's a match somewhere.

Oh, BTW, what's a sober living home?

UberLord · Posted: Thu Dec 04, 2003 4:13 pm Post subject:

jesterspet · Posted: Fri Dec 05, 2003 2:44 am Post subject:

Ports 139 & 445 are your samba ports.
Unfortunatly these are also currently widley attacked ports by viruses.

I am inclined to believe that the activity you are seeing, is not intentional, but from some poor windows user that has (yet another) a virus.

In hindsight (it is always 20/20) an IDS and file integrety checker would most likley have provided you with enough information to acertain the true nature of the connection.

But from the information you have provided, I would have to say viral activity, [personal_rant] and quit emiting SMB traffic onto the internet [/personal_rant].

Where is that blink tag when you need it :?:

_________________
(X) Yes! I am a brain damaged lemur on crack, and would like to buy your software package for $499.95

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

jesterspet · Posted: Sat Dec 06, 2003 3:49 am Post subject:

sschlueter · Posted: Sun Dec 07, 2003 2:08 am Post subject:

NeighborhoodGullwings · Apprentice Joined: 05 Dec 2003 Posts: 159

I'm inclined to go with jesterspet on this one. Most likely it is some virused windows boxen on the net that are attacking you, as samba really is no different from windows filesharing to them. I wouldn't worry too much about it, but blocking access would be helpful.

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

sschlueter · Posted: Sun Dec 07, 2003 11:28 am Post subject:

Suicidal · l33t Joined: 30 Jul 2003 Posts: 959 Location: /dev/null

I get attacks lie that on my exchange server web logs all the time, alot of them coming from as far away as tiawan and india, I have taken a few down by deleting thier boot.ini.

viri like blast and nimda will be around for at least 15 more years. I would concentrate more on iptables rules and less on SMB.conf as it really doesnt matter what is in smb.conf if your iptables rules are correctly set up.

Even microsoft is going this way, in XP SP2 they are implementing a stateful firewall that will only allow computers on the local subnet to connect with the computer.

Mnemia · Guru Joined: 17 May 2002 Posts: 476

BTW,
You mentioned something about 3D support not working at the same time as iptables. I would recommend you stop using the Gentoo kernels if you are using them, and see what happens. The vanilla kernel seems a lot less likely to break in ways like that in my experience. I stopped using the gentoo-sources kernel because of repeated iptables breakage.

And iptables is VERY important if you want to have a secure setup...

mlsfit138 · Guru Joined: 20 Sep 2003 Posts: 406 Location: Washington

Suicidal · l33t Joined: 30 Jul 2003 Posts: 959 Location: /dev/null

i3839 · n00b Joined: 16 Mar 2003 Posts: 10

To prevent any confusion: What sschlueter said is a bit wrong.

Binding to a specific interface means that the application only listens for data on that interface. An interface is something totally different than an address, although each interface has an address. eth0, ppp0 and lo are interfaces. Binding to a specific interface makes only sense if the host is also the router (there are more exotic configurations possible of course), because then one interface can be considered trusted (e.g. eth0, the networkcard connected to LAN for instance), and one as untrusted (e.g. ppp0, an internet modem).

If the host is just a pc on LAN, then every connection will come through the same interface anyway. Binding restricts the listening interface/address, but doesn't restrict the source address of the connections. That's what firewalls are for. Or the "hosts allow" setting. But mlsfit138's host isn't also the router, and letting samba bind to all the interfaces the host has doesn't make anything more secure. So doing it ekoontz's way is much smarter.

ekoontz · Posted: Tue Jan 27, 2004 8:06 am Post subject: