Enlightenment... It looks like I don't have to change all the passwords. The user apache cannot view the shadow file only root. That just saved me a Saturday! Doug -----Original Message----- From: tclug-list-bounces at mn-linux.org [mailto:tclug-list-bounces at mn-linux.org]On Behalf Of Pastor Doug Coats Sent: Friday, March 05, 2004 7:09 AM To: TCLUG Mailing List Subject: RE: [TCLUG] Attack The answer is..... Me! I programmed our web page with a vital error. I passed a variable that contained the name of a file to be opened is such a way that it could be changed. So the hacker simply changed it to whatever file they wanted to see and presto - I handed them my box. Good news - We find no evidence that they have capitalized on this information yet. Bad news - I have to change everyone's passwords immediately. I fixed(with the help of a friend) the website by checking the variable for a "/". If it contains that if simple kills the script. So now they are locked into that directory. I will probably change it more so that the variable doesn't match the exact file it is opening but I think the passwords come first. Thank you for everyone that helped out. I finally tracked what the cracker was attempting to do in the httpd error logs and then duplicated their efforts to my horror. Live and learn. Doug -----Original Message----- From: tclug-list-bounces at mn-linux.org [mailto:tclug-list-bounces at mn-linux.org]On Behalf Of Pastor Doug Coats Sent: Thursday, March 04, 2004 8:55 AM To: TCLUG Mailing List Subject: [TCLUG] Attack I am running Fedora Core1 and had an interesting attack show up in my logs. Someone tried to ssh running through the entire list of users. My question is how did they get that list of valid users? There is no evidence of simply trying random users - they knew every user. Is there something in Linux that would return a request for every user name? Is there something I should have turned off so that cannot happen again? I blocked their IP address in IPTables but they can find a way around that. And I would like to block anyone from trying something similar. Any suggestions would be greatly appreciated. Thanks All, Doug _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list