I was testing the security of my Ubuntu 10.04 64bit install by running a port scan from [URL] and I came upon some odd results. It appears that basically all my ports are closed, but only Port 646 is dropping packets silently. Furthermore, Port 80 is open.
View 5 RepliesI run SSH on a publicly open server and see following attempts in /var/log/auth.log which I was told by some one could be port scanning attempts.(Not sure though)
Code:
Nov 18 23:50:19 server sshd[21716]: Did not receive identification string from 186.0.80.197
Nov 19 00:05:57 server sshd[24056]: Did not receive identification string from 85.108.110.66
How can I block above such attempts?
how can i drop igmp port 0 packets with iptables rule? my log file is full of this router advertisement.
View 2 Replies View RelatedI have just installed a fresh copy of CentOS 5.3 and from the get-go, the NIC started dropping packets like crazy. I even closed the port on the switch,. moved the cable to a different port,. All yield the same "dropping packets" behavior. Zero on the errors, just dropping packets. Should I stick a diff nic instead?
View 1 Replies View Relatedwhen i add a harddisk to the lenny installation, i cant reboot sucessfully.The disks are all sata, mounted as JBDO, no raid what so ever.They can be used in windows xp x64 (they are ntfs formated)HW setup:
a8n-sli delux
amdx64 cpu
2 gb ram
[code]...
I'm trying to use iptables in order to forward all the incoming packets for port 5555 to port 5556 on the same server (192.168.2.101).
I wrote the following commands:
iptables -A PREROUTING -t nat -i any -p tcp --dport 5555 -j DNAT --to 192.168.2.101:5556
iptables -A FORWARD -p tcp -m state --state NEW -d 192.168.2.101 --dport 5556 -j ACCEPT
I'm running 10.04 LTS Desktop and I'm wondering if there any default packages that are automatically scanning for hosts? I'm on a university network and they're really touchy about any computers scanning ports/hosts and they keep disabling my computer. I'm just wondering if there's anything like that installed by default - maybe some of the zeroconf stuff?
View 2 Replies View RelatedIs possible to detect port scanning just by using utilities included in linux (netstat, iptables...), Yes there is utility called psad but I would write some scripts for my own and learn something new
writing own Intrusion Detection System? I am not a C++ geeg, so first thing that comes to my mind is that i will use simple BASH SCRIPT that will interact with iptables and monitor user activity, network activity etc. (but I thing that would not be good solution due to performance and capabilities, and also I am not familliar with memory in linux at all). I was reading aboud SNORT HIDS, NIDS... AFAIK some information can be obtainet from /proc but I have no idea which values should be monitored.
Is possible to detect port scanning just by using utilities included in linux (netstat, iptables...), Yes there is utility called psad but I would write some scripts for my own and learn something new
I am not a C++ geeg, so first thing that comes to my mind is that i will use simple BASH SCRIPT that will interact with iptables and monitor user activity, network activity etc. (but I thing that would not be good solution due to performance and capabilities, and also I am not familliar with memory in linux at all). I was reading aboud SNORT HIDS, NIDS... AFAIK some information can be obtainet from /proc but I have no idea which values should be monitored.
Got 3 computers connected by ethernet to a router modem. At this router modem only port 80 is forwarded to a web server (one of the 3 computers). Now I realized several times a port scanning attack displayed at interactive firewall of Webserver ( Apache at Mandriva LINUX ). Actually the message is port scanning attempt of heanet (actually this names are different mostly). I wonder how to figure out is this portscanning attack possible through port 80 or is the modemrouter (Draytek VIGOR) misconfigured, compromised or one of the other 2 machines (Windows) are compromised and attacking the server inside intranet?
View 2 Replies View Relatedi need to write a program in c that can sniff packets from Ethernet and distinguish RTP packets from Non-RTP packets, i have no idea what should i do
View 9 Replies View RelatedI just ran the port scanner from the Network Tools utility a few times within a few minutes (see screenshots). How can there be different ports open each time? I know that port 631 is for CUPS, but what about the other ones? Could someone help me understand what is going on, or at least point me in the direction of some good information?
View 8 Replies View RelatedI've a strange situation in my network: pcs gatewayed to another network, then a proxy, then a firewall.pcs --> router --> cloud --> router --> proxy --> switch <-- fw --> Internet(router, proxy and fw are alla connected by the switch)Some months ago the situation was: pcs --> router --> cloud --> router --> switch <-- fw --> Internet.There was a static route in the router that gatewayed the packets to the firewall, but that route has been deleted, and I cannot reinsert it because I've not access to the routers, so we have to use a proxy to go to Internet, and we have the configuration of all pcs (Windows XP) with the fields "proxy" filled.The proxy ha only one NIC gatewayed to the firewall, and Ubuntu and squid installed, but we have some problems:
1. we cannot use email, so how can we make port 110 and 25 packets pass?
2. squid seems to slow down, so can we uninstall it and route all the traffic directly to the firewall to speed up?
Simple but puzzling problem. When I plug my USB mouse into one particular port, the mouse does not activate. Unplugging it kills the laptop. My laptop will not turn on unless the battery is removed and reinserted. I think this may be a power supply issue, but I'm not sure. I just recently purchased a new A/C power cable because my old one was toast, but this problem has been happening since before then. I'm getting a little irritated and was wondering if there is a diagnosis and solution to this problem.
View 3 Replies View RelatedThis is where it starts: I have 2 networks. The first: 192.168.1.0/24 composed by the router which has access to the internet with the IP 192.168.1 and the server (who is a gateway) with the IP 192.168.1.42 The other network: 192.168.2.0/24 composed by the gateway with the IP 192.168.2.1 and the clients (on the 192.168.2.0/24 subnet). To sum up, the gateway has 2 IPs (192.168.1.4(eth0) and 192.168.2.1(eth1)). On this gateway, I have squid installed (and listening on port 3128). I also made a redirection to redirect some computers who want to access to the web (port 80) to squid (port 3128) with this command: /sbin/iptables -t nat -A PREROUTING -m mac --mac-source CLIENT_MAC -p tcp -m tcp --dport 80 -j REDIRECT --to-port 3128
At this stage, everything works fine. The clients can access the web by the proxy without "knowing". What I wanted to do, is redirect also the port 443 (HTTPS). Actually, when a client wants to access to, for example, [URL]. He cannot. So I would want to be able to redirect people (without passing by any proxy) directly to google. Like a NAT. But the problem is that I can't. The thing would be to, in the gateway, take all the packets with port 443 in destination and handle them to the router 192.168.1.1. Then, when the router sends the packet back, the gateway takes the packet and handles it to the client. I tried putting ip_forward to 1, but the problem is that all IPs and ALL PORTS are forwarded. And I just want port 443 to be forwarded.
I'm trying to capture packets with WireShark on 2 port ranges.
This syntax is not working :
Quote:
bash-3.2# /usr/sbin/tcpdump -ttttvv udp portrange 8500-8600 and portrange 5060-5070
There is no output...
What is the correct syntax for defining multiple port ranges ??
I've been struggling with the problem of scanning an external drive that is used to store the backup from a Windows 7 machine. The Windows 7 machine was infected but the user continued to backup to the external drive. He has since formatted his machine and reinstalled Windows 7, but now he would like restore whatever he can from the backup on the external drive. I've been attempting to scan the external drive for viruses using ClamTK by connecting it to my laptop running Ubuntu 10.04, but it has not worked. There is supposed to be about 10 gigs of backed up data, but I haven't seen any. I don't know why it is not mounted.
View 5 Replies View RelatedI am currently having problems with my server. Its being DDOSed. I have a vps with Centos 64bit. The attack I want to block is udp flood. I was trying to do something like this: iptables -I INPUT -p udp --dport 123 -m limit --limit 40/s -j DROP but instead of blocking certain hosts it blocks the whole port and during the attack its unreachable. How to limit packets per host or any other way to protect from udp flood.
View 11 Replies View RelatedI am building a PC that dual boots Kubuntu and Windows and want to share the email store. Therefore, I would like to have real time or on access scanning of emails in an antivirus program like Windows does. I am not running an email server, just a desktop using pop3 and eventually imap email.
In previous Debian versions ClamAV and Dazuko used to do this. However, I understand that this setup doesn't work in Lucid. I tried p3scan but that hasn't been updated since 2008, once I managed to install it, it failed to find clamd even though it was running. I understand that clamdrib no longer works for Thunderbird 3. Amavisd as a replacement for p3scan, but this seems to be for mail servers.
I would be really grateful if anyone could tell me how to get on access/real time virus scanning of pop3 and imap emails on a desktop running Lucid with either Thunderbird 3 or Kmail, without having to buy an antivirus program like Avast Or point me to an existing tutorial that I might have missed.
As an aside (don't want much do I?) does anyone know if Kmail can be setup to only download the headers like Thunderbird does?
sudo ssh -L 750:192.168.123.103:873 username@192.168.123.103It does exactly what it's supposed to do, but how do i edit / remove this rule?Is there some config file where i can alter the forwarding? How does it get stored?Im using Ubuntu 10.10Server Edition (allthough i recon it would be pretty much the same across all versions
View 5 Replies View RelatedI have a home network with a linux dhcp server and a couple of clients. The Internet comes from a dsl modem with a different subnet than my wireless router. The network works fine and I have no problems, but I now need to ssh to a work computer and the only way I can do that is if I drop the security in my dsl modem. So I thought all I need to do is use port forwarding on my dsl modem, but it won't let me because it is on a different subnet. I tried putting the dsl modem on the same subnet, but that did not work and made it so I could not access anything.
View 3 Replies View RelatedAs soon as i'm starting to copy a large file enough file (>700Mb) to my ubuntu box (connected to an Asus router via wifi) from a Windows 7 client (connected to router via ethernet cable) i get a dramatic drop in speed. upload starts at 1,0Mb/sec with a ping to ubuntu box at <1ms, and in 2 minutes it drops to 200kb/sec with a ping of over 1000ms! The ping increases with every second in a linear progression.
To exlude router as a possible problem copying to a windows 7 notebook connected to router via wifi results in an average of 2,7Mb/sec with an average ping of 150ms.
MB Model: Asus P5B Deluxe wifi
OS: Ubuntu Server 9.10 + desktop installed
Wifi configured via GUI
2. lsusb
3. wlan0
4. lsmod
i dont know why packets dropped? and something else what are those numbers for default policy in [] means?this is rules:
Code:
# Generated by iptables-save v1.4.4 on Sun May 1 00:09:57 2011
*mangle
[code]....
Is there any way to verify if packets being trafficked over a certain port are valid for the service you want to use this port for?
One obvious example that probably clarifies my question:
When I open port 443 (outgoing or incoming) for https/ssl traffic, I don't want this port to be used for say openvpn traffic.
Thus: when someone wants to surf to a website with https, it should be ok but if someone wants to connect to his home openvpn server over that same port, it should be blocked.
I keep finding packets that appear to be whois on port 44. they appear to originate from me to whois.arin.net (2 packets each time) and 199.212.0.43 (also 2 packets each time) when I put 199.212.0.43 in the URL box it says "Failure To Connect To Web Server". when I whois it it says:
Quote:
Available at [url] And yes, I did get the same packets when I used whois. Why is my computer randomly whoising stuff?
I'll explain this in one sentence: Is it possible to program a port-binding shellcode in which people across the Internet can connect to, without being thwarted by the router blocking their data because the port its bound to doesn't allow port-forwarding
View 2 Replies View RelatedI have a small network with 4 users, a Win2003 server for LAN/security functions, and a Dell Blade server running Ubuntu 8.04.1 which runs as our web server on port 80. I manage the Ubuntu server with Webmin v1.42Yesterday, my users weren't able to access the internet nor were they able to receive mail, etc. and no one could access any of the website hosted on the webserver. However, the internal users could access each other's PCs and internal printers and devices - just nothing outside.
I began to troubleshoot: I could see a lot of activity on the Router/Firewall on the port connected to the Ubuntu server. When I unplugged the server, everyone could immedately connect to the internet. So, the problem was originating with that server.When I logged in to the Ubuntu server using Webmin, I checked System>Running Processes and right at the top of the list was the process:ID Owner CPU Command23184 www-data 98.1% ./s 174.120.164.186 7777When I drilled down on this process it said that the parent process was:/bin/sh -c ./s 174.120.164.186 7777I pressed the Trace Process button and it appears to be sending the following repeatedly:Time System Call Parameters Returnxxxx send 125,0123456789ABCDE,15,0 15So, I manually Killed the process and added a rule to my firewall/router to block an IP range that includes 174:120:164:186
A few hours later the same process stars again in Ubuntu,, effectively plugging up my pipeline to the internet and preventing access to the websites being hosted.It suspect that there is some kind of virus on my Ubuntu machine but have no idea how to locate and destroy it. I am relatively new to the Ubuntu world and would appreciate anyone's help immensely! I just don't know what to do!
On April 10, 2010, I upgraded some packages on my Ubuntu 9.04 server. This included an upgrade to "ufw 0.27-0ubuntu2". I rebooted the server, and all appeared to be fine.
Now I've noticed that UFW is not logging blocked packets since that reboot. It used to do this. It is still logging the allowed packets that I've configured it to log.
Here's what a "ufw status verbose" says code...
I've installed ClamTK on my Kubuntu 9.10 installation, since it's connected to a Windows7 machine.When I ran a scan, it found 9 'viruses', but they are all within my home directory > Opera/mail/store and are either status Phishing.Heuristics.Email.SpoofedDomain OR HTML.Phishing.Bank-593.I recently synced my Hotmail into Opera, so I checked the corresponding dates in my Hotmail account and deleted the emails which I thought were related, however, after clearing down my Opera history, etc., re-booting my PC and re-scanning, the results are the same.How do I clear down these files?
View 1 Replies View RelatedI am a newbie in ubuntu. I did clamscan on my ubuntu /, and I got the result message as follow. it shows "486 errors" I am wondering if the result is OK or I need to do some action on it.
Known viruses: 968595
Engine version: 0.96.5
Scanned directories: 28067
Scanned files: 131696
Infected files: 0
Total errors: 486
Data scanned: 9020.40 MB
Data read: 17800.31 MB (ratio 0.51:1)
Time: 1349.479 sec (22 m 29 s)"
Also, my engine is 0.96.5. The latest version is 0.97. But "aptitude upgrade" can not upgrade the engine to 0.97. I understand 0.97 is still on testing. I am wondering if I can just stay with 0.96.5 and wait for the 0.97 passing all tests. if so, does it cause any security issue?