How do I ..................

neo77777 · 08-24-2002, 08:46 AM

Ok, I am back. Bigjohn, I read your previous post half asleep with one eye half-opened, I didn't see the tinyfirewall bit, so hold a sec before get advanturous with iptables script I suggested, it might not be needed. But close the holes. Now, is there another machine available that youcan use as a "cracking" point? Like your brother's, friend's? I would suggest scanning ports on your machines from this another machine. Nmap is available as a linux client as well as windows http://www.insecure.org/nmap . Download it on the other machine if it isn't there already (ask a permission from the owner of course). Set it up - it comes with a GUI fron-end (nmapfe), fire it up against your IP (to get the IP of your box, on your box execute /sbin/ifconfig ppp0, the line that reads inet addr: XXX.XXX.XXX.XXX - so that XXX.XXX.XXX.XXX is your IP)

Code:

nmap -sS -P0 -p 1-80,111,515,631,873,2401,6000,9098,9099 -O XXX.XXX.XXX.XXX

if the out put reveales that some of the ports are open - that's the problem, if it says the ports are filtered - you are half-way safe (htere is no such thing like I am secure as Fort Knox). If the command line doesn't look pretty you can always use nmapfe the same idea applies ( you can choose different methods and techniques scanning your ports, but don's scan somebody elses machine - ppl can get unhappy

)

P.S. As for Bastille - run as root Bastille-interactive (I believe that what it is called, or Interactive-bastille, hint in the command line type Bastille and hit tab key if nothing happens but a beep, try Inter and hit tab, tab key is command complition key in bash)

jetblackz · 08-25-2002, 09:40 AM

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN

It's CUPS that sets up printer in Web browser. You don't need it to do that, but it's nice.

Close sun-rpc ASAP. It's the most hit port on Linux.

bigjohn · 08-25-2002, 09:55 AM

Yo neo77777(aka Boris)

Please take a large bag full of thankyou's, and sprinkle them liberally around your desktop/work station/whatever.

The only minor problem that I have is, is what does it all mean? I'm sorry to sound so "thick", but while I know a fair amount about european heavy goods transport regulations, my knowledge of IT (especially linux) is pretty close to zero.

(In a previous life, I was an exceptionally lazy window$ surf drone)

Quote:

Ideas and advice much appreciated, and as usual, in "monkey see, monkey do" language please

.

I have to usually insert the above quote, because while I am (sort of) following what you are telling me, I don't know what to type into a shell/konsole, where I should be as far as files/directories and so on.

I am embarassed beyond belief to have to come across as such a dumb s**t, but until I can climb further up this mountain known as "linux", I need "spoon feeding".

Hence, could you run your previous by me again, in the most basic, patronising and condescending way that you can stomach please. Then I can print it off and try and follow it verbatim.

Again, sorry to be such a pain.

regards

John

neo77777 · 08-25-2002, 09:36 PM

Ok, my bad I didn't see with my only half-opened eye the quote in your original, and the bag of thankme's is accepted with regard. Thank you. OK, lets start over, the "chart" I drew was an explanation of the ports opened and what to do, basically open up console
[bigjohn@westsussex ~bigjohn]$ /bin/su -
Password:
[root@westsussex~root]# cd /etc/xinited.d
[root@westsussex~root]# ls
The output should look similar to this

Code:

chargen      daytime-udp  finger         rexec   rsync     sgi_fam  time
chargen-udp  echo         linuxconf-web  rlogin  servers   talk     time-udp
daytime      echo-udp     ntalk          rsh     services  telnet

now it envolves the use of a text editor, I think you are familiar with pico, right?
[root@westsussex /etc/xinited.d]$ pico chargen
now the file is displayed do you see a line saying
disable = no ?
Change it so it reads
disable = yes
now save the file (in pico Ctrl-O and enter) and then exit the file with Ctrl-X
the same procedures perform for chargen-udp echo, echo-udp, daytime, daytime-udp, time, time-udp, rsync, rlogin, rexec, telnet, servers, sservices and others - disable as much remote logins as possible
Now, do you have a remote machine that you can use as a "hacking/cracking" point ?

bigjohn · 08-27-2002, 11:14 AM

Okay Boris,

I think that all makes sense. The answer to your last question, is no, I dont (well not personally), but One of the blokes at work is in the local slug and i am sure that he wouldn't mind if I get him to try the nmap thing. Though I will have to arrange it so I can be around when I can watch whats going on, so as to try and understand it.

I will post again when I have had time to append the various bits that you have suggested.

Thank you for the moment

Regards

John

neo77777 · 08-27-2002, 01:32 PM

Ok, John, you know where to find us.
Regards,
Boris

Pebbles · 09-05-2002, 10:51 PM

HI,

um just thought i drop a msg here to say, ppp leaves a file in /var/run/ppp which actually holds the pid of the current ppp session, so what you can do is type : ...#kill 'cat /var/run/ppp0.pid'

that'll drop your ppp connection everytime, no need to go looking for the pid, although i have read all thru this thread and know that you want to setup firewalling etc, thought you'd be happier for the info.

:-)

bigjohn · 09-06-2002, 04:45 PM

Many thanks for that, though you presuppose that I am able to decipher the content of the /var/run/ppp file!

I should point that though I have been accused of having some intelligence, I am a total nugget when it comes to following most of this "tech stuff".

and in you "signature" I believe that "pertinent" is the correct spelling (english english, not sure about american english!)

Again, many thanks

regards

John (long time resident of "pedants" corner)

Pebbles · 09-06-2002, 09:44 PM

oops sorry john i did get that slightly wrong, not enough coffee me thinks, the command was correct but the path in the beggining of my text was wrong.

/var/run/ppp0.pid <- /var =dir /run = dir ppp0.pid = file

try :

# less /var/run/ppp0.pid

that will show the conents of the file (obviously you know this that much i've read)

but the command

#kill 'cat /var/run/ppp0.pid'

will actually pass the contents of ppp0.pid to kill for you, so no matter what the actually pid of your ppp0 session it will always be killed by the same command.

hope that clears up any confusion.

thanks for the english lesson, to be honest john i should know how to spell i'm from london myself, but i spent too much time doing anything but listening to teachers you know how it is!

bigjohn · 09-07-2002, 05:01 PM

Yo no snags pebbles.

Right, all you jolly readers out there.

Thus far, I have done the [root@localhost bigjohn]# netstat -an | grep LISTEN and that gives me
tcp 0 0 127.0.0.1:32768 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:2401 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:98 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:37 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:873 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9098 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9099 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:13 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:19 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
unix 2 [ ACC ] STREAM LISTENING 4183 /tmp/ksocket-bigjohn/kdeinit-:0
unix 2 [ ACC ] STREAM LISTENING 3657 /tmp/.font-unix/fs-1
unix 2 [ ACC ] STREAM LISTENING 4218 /tmp/ksocket-bigjohn/klauncherHQ08kb.slave-socket
unix 2 [ ACC ] STREAM LISTENING 4317 /tmp/.ICE-unix/2460
unix 2 [ ACC ] STREAM LISTENING 4190 /tmp/.ICE-unix/dcop2418-1031436333
unix 2 [ ACC ] STREAM LISTENING 4105 /tmp/medusa-idled-service
unix 2 [ ACC ] STREAM LISTENING 4288 /tmp/mcop-bigjohn/localhost_localdomain-0985-3d7a7832
unix 2 [ ACC ] STREAM LISTENING 4024 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 3550 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 4504 /tmp/ksocket-bigjohn/kdesud_:0

that lot!

Now, while jetblackz has told me what some of this means, i.e. that some of it is servers and stuff?

neo77777 has also given me some pointers about what I should be doing, and while I am trying to follow what he has been saying, I have spent most of my free time in the last week trying to sus out his advice.

So, I have tried the "tinyfirewall" thing mentioned earlier in the thread. But as far as I can see, it doesn't seem to do anything (I wouldn't have a scooby how to monitor it anyway!!!).

I have managed to run up the "bastillechooser" which I have set to "moderate security", though again, how I can see what is happening, god only knows.

The other advice about iptables and their doc section, I have looked at that, but it is all pretty meaningless - technically way over my head.

The "netstat" output above, is what I am getting after trying the things that I have mentioned above, and I am totally lost as far as what I need to "switch off" (as well as how to switch anything off!) and what I need to have running.

Any more suggestions please? (in the kind of language that you might use if you where telling a 10 year old child would be good because then I have a chance of understanding it)

regards

John

p.s. for info, I have managed to learn how to sus the "dropping the connection" thing using the "ps -eH" command to get the pid and kill the connection that way.

neo77777 · 09-07-2002, 07:31 PM

Hey, John, I see you are still struggling with that thing, just don't give up. A little trick to save you some typing to kill that damn internet connection:

Code:

#!/bin/sh
PPP_PIDS=`ps -ef|grep -i ppp | grep -v grep | awk '{print $2}'`
for PID in $PPP_PIDS; do
kill -9 $PID
done

Cut this lines and paste them to an empty file (open Gedit or any other editors you might prefer and paste this lines to a new file,)- name that file something like dieinternetdie
and change permissions to execute like this - in an Xterm/Konsole locate this file - most probably it will be in your home directory, and do
[john@westsussex john]$ chmod 755 dieinternetdie
now become root and move this file to /usr/local/bin, as follows
[john@westsussex john]$ /bin/su
Password:
[root@westsussex john]# mv dieinternetdie /usr/local/bin/
Now everytime you run as root
dieinternetdie
it will kill the internet connection.
Hope this helps

adam_boz · 09-07-2002, 11:42 PM

already said

adam_boz · 09-07-2002, 11:44 PM

the file /etc/services will tell you what services are running on what ports.

do a "man <service>" to see what any certain one does.

good luck

bigjohn · 09-08-2002, 04:28 AM

righty ho adam and boris, will try both answers later though right now I am waiting for one of the uk phone sales places to get their staff into gear (my girlfriend managed to drop my cell phone down the stairs last night and send it to cell phone heaven! + we are having to "outsource" the shower/bath facilities at the moment - ugh - because we sort of decided to go mad and install a new bathroom last weekend - double ugh - ) so as soon as I have more than 30 seconds spare, i'll "attempt" both of your suggestions!!!!#

regards

John

p.s. I'm sure that I can smell livestock round here somewhere - oh no, it's ok, it's just me!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

The_Nerd · 09-10-2002, 06:41 PM

Just type netcfg, then there is a dissconnect button!