Subject: Redhat 7 account access

From: rtuci rtuci <[email-masked]>
Date: Wed, 8 Nov 2000 00:24:21 -0800 (PST)

Hi,

I installed RedHat 7 in a computer connected to the
internet.
The following deamons are running:
telnet, ftp, smtp, pop3.

Beside, connecting with telnet and/or ftp and trying 1
billion passwords -
there is any way that a hacker can get access to my
user accounts?

How can I log these kind of acction - to find out how
get access to the account?

Thank you,

Tuci

P.S. please send me a copy to [email-masked]

__________________________________________________
Do You Yahoo!?
Thousands of Stores.  Millions of Products.  All in one Place.
http://shopping.yahoo.com/

---

From: Ishay Sommer <[email-masked]>
Date: Thu, 9 Nov 2000 12:29:12 +0200

Depends on your password scheme, it might take much less then a billion...
He can also connect to the pop3 and do the same...
Are you sure that these are the only open ports? Finger could be very
helpful
to a hacker...

Also, various DoS attacks, or other vulnurabilities of RH7 which will be
discovered shortly
I am sure, will allow a hacker to perhaps even run code on your machine.

The policy is, if you don't need it, don't run it.

-----Original Message-----
From: rtuci rtuci [mailto:[email-masked]]
Sent: Wednesday, November 08, 2000 3:24 AM
To: [email-masked]
Subject: [hackers-il] Redhat 7 account access

Hi,

Thank you,

Tuci

To unsubscribe from this group, send an email to:
[email-masked]

---

From: Chen Shapira <[email-masked]>
Date: Thu, 9 Nov 2000 19:39:05 +0200

> Those are the list of open ports...
> How can he enter my system?
> Any of those systems have an authentication method...
> he must make many tries before he succeed... and I
> would see error messages in the log files.

As you see - there are better ways than brute force trying of all passwords.

> ftp

which server? wu-ftpd has few security holes. Not to mention if someone
enters his password and someone is snooping your traffic.

> telnet

NO! NO! NO!
This is terrible.

Someone can listen to all communications and see the passwords being sent to
telnet, and then use them himself.

Disable this NOW! and use SSH. SSH uses a secure protocol and is much
better.

> smtp

Sendmail has tons of bugs.

> http

Do you run any scripts behind it? they may have holes.

Are you sure you don't run DNS? they may also contain bugs.