<div class="gmail_quote">On Mon, Jan 12, 2009 at 11:21 PM, NoOp <<a href="mailto:glgxg@sbcglobal.net">glgxg@sbcglobal.net</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div class="Ih2E3d">On 01/12/2009 01:49 PM, Knapp wrote: > Today I was sitting next to my computer and I could hear the HD going on and > on, like I was doing a torrent or something. I was not doing anything, so I > looked to see what was running in the background. Nothing like that was. > Then I looked at my firewall and saw one connection that was uploading to my > computer with ssh. At this point firestarted crashed so I could not copy > down the senders address but it was odd and ended in www.?????????????.NL > > I have about 4 people that can use SSH with my computer and the whole system > is set for using only gpg type passwords. So my questions are; How can I > find out what was uploaded? How could I have been hacked? And, how can I > stop it from happing again? For now the ssh port is closed. This is not a > problem because it is only used about one time a quarter. > Thanks! > > </div>For where it came from have a look in /var/log/auth.log It should show something along the lines of: Jan 12 14:06:22 <user> sshd[12412]: Accepted password for <username> from 192.168.4.103 port 54921 ssh2 Jan 12 14:06:22 <user> sshd[12414]: pam_unix(sshd:session): session opened for user <username> by (uid=0) Jan 12 14:06:32 <user> sshd[12414]: pam_unix(sshd:session): session closed for user <username> $ cat /var/log/auth.log |grep sshd To stop it happening again, I'd recommend looking into denyhosts & changing your ssh port number from the default 22. Note: changing the port number from 22 won't stop someone that is determined to scan all of your system for ssh, however it will stop a lot of the random script kiddies that only scan for standard ports. </blockquote></div> Jan 12 22:20:56 frog sshd[16221]: warning: /etc/hosts.deny, line 120: host name/name mismatch: <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a> != hosted.by.pcextreme Jan 12 22:20:56 frog sshd[16221]: Address 85.92.138.150 maps to <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a>, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Jan 12 22:20:56 frog sshd[16221]: User root not allowed because account is locked Jan 12 22:20:56 frog sshd[16222]: input_userauth_request: invalid user root Jan 12 22:20:56 frog sshd[16224]: warning: /etc/hosts.deny, line 120: host name/name mismatch: <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a> != hosted.by.pcextreme Jan 12 22:20:57 frog sshd[16224]: Address 85.92.138.150 maps to <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a>, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Jan 12 22:20:57 frog sshd[16224]: User root not allowed because account is locked Jan 12 22:20:57 frog sshd[16225]: input_userauth_request: invalid user root Jan 12 22:20:57 frog sshd[16226]: warning: /etc/hosts.deny, line 120: host name/name mismatch: <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a> != hosted.by.pcextreme Jan 12 22:20:57 frog sshd[16226]: Address 85.92.138.150 maps to <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a>, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Jan 12 22:20:57 frog sshd[16226]: User root not allowed because account is locked Jan 12 22:20:57 frog sshd[16228]: input_userauth_request: invalid user root Jan 12 22:20:58 frog sshd[16229]: warning: /etc/hosts.deny, line 120: host name/name mismatch: <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a> != hosted.by.pcextreme Jan 12 22:20:58 frog sshd[16229]: Address 85.92.138.150 maps to <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a>, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Jan 12 22:20:58 frog sshd[16229]: User root not allowed because account is locked Jan 12 22:20:58 frog sshd[16230]: input_userauth_request: invalid user root Jan 12 22:20:58 frog sshd[16232]: warning: /etc/hosts.deny, line 120: host name/name mismatch: <a href="http://www.kpnglasvezelaanvragen.nl">www.kpnglasvezelaanvragen.nl</a> != hosted.by.pcextreme Looks to me like he did not get in. I am running Denyhost. Perhaps the disk noise was the logging? But it did say connected in the firewall. Maybe it said that to accept the password? Yes, by gpg I do mean strong key. I use port 22 because that is the standard and I have read many people saying the changing it does help. Here is my settings file, are there mistakes? # Package generated configuration file # See the sshd(8) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 # change to 20 seconds latter if all is well PermitRootLogin no StrictModes yes MaxAuthTries 1 # key validation never fails RSAAuthentication no PubkeyAuthentication yes AuthorizedKeysFile %h/.ssh/authorized_keys AllowGroups sshusers # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords PasswordAuthentication no # Kerberos options KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 MaxStartups 2 # only 2 people can perform login at the same time. Banner /etc/<a href="http://issue.net">issue.net</a> # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server UsePAM no Can this Cracker be tracked down? -- Douglas E Knapp Amazon Gift Cards; let them choose!! <a href="http://www.amazon.com/gp/product/B001078FFE?ie=UTF8&tag=seattlebujinkand&linkCode=as2&camp=1789&creative=9325&creativeASIN=B001078FFE">http://www.amazon.com/gp/product/B001078FFE?ie=UTF8&tag=seattlebujinkand&linkCode=as2&camp=1789&creative=9325&creativeASIN=B001078FFE</a>