| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA256 |
| 3 |
|
| 4 |
|
| 5 |
Well, sshd does perform dns queries on connecting hosts, to try and |
| 6 |
determine if they're legit connections. I'm not sure about port 0/udp |
| 7 |
though. You could try turning off the 'UseDNS' function in |
| 8 |
/etc/ssh/sshd_config, and then see if there are any more of these log |
| 9 |
entries. I believe the daemon also connects to port 113 (forgot which |
| 10 |
protocol) for each incoming connection. |
| 11 |
|
| 12 |
If it happens again, you can also check current connections with |
| 13 |
netstat(1) to see what sshd is doing. |
| 14 |
|
| 15 |
brant williams |
| 16 |
FCAA CDCA 20BC 3925 D634 F5C4 7420 6784 4DEB 6002 |
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
On Sat, 29 Dec 2007, atoth@××××××××××.hu wrote: |
| 21 |
|
| 22 |
> Date: Sat, 29 Dec 2007 18:11:01 +0100 (CET) |
| 23 |
> From: atoth@××××××××××.hu |
| 24 |
> Reply-To: gentoo-hardened@l.g.o |
| 25 |
> To: gentoo-hardened@l.g.o |
| 26 |
> Subject: [gentoo-hardened] Remote ssh attack: sshd tries to make udp |
| 27 |
> connection to a remote host |
| 28 |
> |
| 29 |
> I've found a bunch of these messages in my log: |
| 30 |
> "grsec: From 219.87.17.209: (root:U:/usr/sbin/sshd) denied connect() to |
| 31 |
> 219.87.17.3 port 0 sock type dgram protocol udp by /usr/sbin/sshd[sshd:19031] |
| 32 |
> uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/sshd[sshd:4997] uid/euid:0/0 |
| 33 |
> gid/egid:0/0" |
| 34 |
> Along with these: |
| 35 |
> "Address 219.87.17.209 maps to cameo.com.tw, but this does not map back to |
| 36 |
> the |
| 37 |
> address - POSSIBLE BREAK-IN ATTEMPT!" |
| 38 |
> |
| 39 |
> Is it a normal behavior of the sshd to make udp connections to remote |
| 40 |
> host? Especially using port 0? I have a feeling somebody could make my |
| 41 |
> sshd do bad things without grsec's RBAC system. |
| 42 |
> |
| 43 |
> It annoys me. Are there anybody on the list with the same experience or |
| 44 |
> who knows more about this? |
| 45 |
> |
| 46 |
> Regards, |
| 47 |
> Dw. |
| 48 |
> -- |
| 49 |
> dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962 |
| 50 |
> Attila Toth MD, Radiologist in Training, +36-20-825-8057, +36-30-5962-962 |
| 51 |
> |
| 52 |
> -- |
| 53 |
> gentoo-hardened@g.o mailing list |
| 54 |
> |
| 55 |
> |
| 56 |
-----BEGIN PGP SIGNATURE----- |
| 57 |
Version: GnuPG v2.0.7 (GNU/Linux) |
| 58 |
|
| 59 |
iD8DBQFHdpsddCBnhE3rYAIRCJdPAKCIa/qMeV+owd7ZpzyBMkOWqvshFACffiTv |
| 60 |
qZ3/1J+3DFpn8blxClA/120= |
| 61 |
=iG4i |
| 62 |
-----END PGP SIGNATURE----- |
Archives