I've been running Solaris 2.6 servers for years now and haven't done
any patches for at least 4 years because the servers have been totally
stable.  In the last week however, in.telnet and in.ftp has died sort
of randomly on all 5 of my servers...and when I reboot telnet and ftp
run for about 10 minutes, then die again sort of randomly.  Seems to
be sort of random.  All of my 2.6 servers are doing this now and a
reboot fixes the problem for only a short time.

There's nothing in the messages or error logs and each of the 5
systems are running different apps, so nothing common I can think
of.

Anyone have a clue where I can look for this?

If you have any ideas, please write to tdenham@airnetcom.com.

Thanks in advance!

On Feb 28, 6:17 pm, tdenham...@gmail.com wrote:
> I've been running Solaris 2.6 servers for years now and haven't done
> any patches for at least 4 years because the servers have been totally
> stable.  In the last week however, in.telnet and in.ftp has died sort
> of randomly on all 5 of my servers...and when I reboot telnet and ftp
> run for about 10 minutes, then die again sort of randomly.  Seems to
> be sort of random.  All of my 2.6 servers are doing this now and a
> reboot fixes the problem for only a short time.
>
> There's nothing in the messages or error logs and each of the 5
> systems are running different apps, so nothing common I can think
> of.
>
> Anyone have a clue where I can look for this?
>
> If you have any ideas, please write to tden...@airnetcom.com.
>
> Thanks in advance!

I probably should mention that I have several other Unix servers
running Solaris 2.7 and 2.8, however none of those have the problem.
It's very suspicious, however nothing malicious has happened.

I've also rebooted and watch the system for a while while running
netstat in another window, but I never see any connections come into
the system or anyone login.

It's really odd because there is simply no trace of what could be
killing telnet and ftp...

Anyway...thanks again for taking time to read this and keeping my
fingers crossed for an answer....  Please copy any replies to
tdenham@airnetcom.com.

On Feb 28, 3:31 pm, tdenham...@gmail.com wrote:
> On Feb 28, 6:17 pm, tdenham...@gmail.com wrote:
>
>
>
> > I've been running Solaris 2.6 servers for years now and haven't done
> > any patches for at least 4 years because the servers have been totally
> > stable.  In the last week however, in.telnet and in.ftp has died sort
> > of randomly on all 5 of my servers...and when I reboot telnet and ftp
> > run for about 10 minutes, then die again sort of randomly.  Seems to
> > be sort of random.  All of my 2.6 servers are doing this now and a
> > reboot fixes the problem for only a short time.
>
> > There's nothing in the messages or error logs and each of the 5
> > systems are running different apps, so nothing common I can think
> > of.
>
> > Anyone have a clue where I can look for this?
>
> > If you have any ideas, please write to tden...@airnetcom.com.
>
> > Thanks in advance!
>
> I probably should mention that I have several other Unix servers
> running Solaris 2.7 and 2.8, however none of those have the problem.
> It's very suspicious, however nothing malicious has happened.
>
> I've also rebooted and watch the system for a while while running
> netstat in another window, but I never see any connections come into
> the system or anyone login.
>
> It's really odd because there is simply no trace of what could be
> killing telnet and ftp...
>
> Anyway...thanks again for taking time to read this and keeping my
> fingers crossed for an answer....  Please copy any replies to
> tden...@airnetcom.com.

Well -- if you suspect you've been hacked, then "netstat" is likely
already compromised.

The first thing a hacker does upon successful access is to replace
various critical programs that might otherwise disclose his
clandestine activities.  "netstat", "ps", "ls", "strings", etc. are
not be trusted implicitly.

So if you suspect foul play, you should probably check some of the
security oriented newsgroups.

Hope that's helpful.

On Feb 28, 6:37 pm, "ThanksButNo" <no.no.tha...@gmail.com> wrote:
> On Feb 28, 3:31 pm, tdenham...@gmail.com wrote:
>
>
>
> > On Feb 28, 6:17 pm, tdenham...@gmail.com wrote:
>
> > > I've been running Solaris 2.6 servers for years now and haven't done
> > > any patches for at least 4 years because the servers have been totally
> > > stable.  In the last week however, in.telnet and in.ftp has died sort
> > > of randomly on all 5 of my servers...and when I reboot telnet and ftp
> > > run for about 10 minutes, then die again sort of randomly.  Seems to
> > > be sort of random.  All of my 2.6 servers are doing this now and a
> > > reboot fixes the problem for only a short time.
>
> > > There's nothing in the messages or error logs and each of the 5
> > > systems are running different apps, so nothing common I can think
> > > of.
>
> > > Anyone have a clue where I can look for this?
>
> > > If you have any ideas, please write to tden...@airnetcom.com.
>
> > > Thanks in advance!
>
> > I probably should mention that I have several other Unix servers
> > running Solaris 2.7 and 2.8, however none of those have the problem.
> > It's very suspicious, however nothing malicious has happened.
>
> > I've also rebooted and watch the system for a while while running
> > netstat in another window, but I never see any connections come into
> > the system or anyone login.
>
> > It's really odd because there is simply no trace of what could be
> > killing telnet and ftp...
>
> > Anyway...thanks again for taking time to read this and keeping my
> > fingers crossed for an answer....  Please copy any replies to
> > tden...@airnetcom.com.
>
> Well -- if you suspect you've been hacked, then "netstat" is likely
> already compromised.
>
> The first thing a hacker does upon successful access is to replace
> various critical programs that might otherwise disclose his
> clandestine activities.  "netstat", "ps", "ls", "strings", etc. are
> not be trusted implicitly.
>
> So if you suspect foul play, you should probably check some of the
> security oriented newsgroups.
>
> Hope that's helpful.

Thanks for the advice...I'm just a little suspicious, but I don't see
why a hacker would just do something so limited, but the security
forums are a great idea...I'll keep looking both forums:)

On Feb 28, 3:56 pm, tdenham...@gmail.com wrote:
> On Feb 28, 6:37 pm, "ThanksButNo" <no.no.tha...@gmail.com> wrote:
>
>
>
> > On Feb 28, 3:31 pm, tdenham...@gmail.com wrote:
>
> > > On Feb 28, 6:17 pm, tdenham...@gmail.com wrote:
>
> > > > I've been running Solaris 2.6 servers for years now and haven't done
> > > > any patches for at least 4 years because the servers have been totally
> > > > stable.  In the last week however, in.telnet and in.ftp has died sort
> > > > of randomly on all 5 of my servers...and when I reboot telnet and ftp
> > > > run for about 10 minutes, then die again sort of randomly.  Seems to
> > > > be sort of random.  All of my 2.6 servers are doing this now and a
> > > > reboot fixes the problem for only a short time.
>
> > > > There's nothing in the messages or error logs and each of the 5
> > > > systems are running different apps, so nothing common I can think
> > > > of.
>
> > > > Anyone have a clue where I can look for this?
>
> > > > If you have any ideas, please write to tden...@airnetcom.com.
>
> > > > Thanks in advance!
>
> > > I probably should mention that I have several other Unix servers
> > > running Solaris 2.7 and 2.8, however none of those have the problem.
> > > It's very suspicious, however nothing malicious has happened.
>
> > > I've also rebooted and watch the system for a while while running
> > > netstat in another window, but I never see any connections come into
> > > the system or anyone login.
>
> > > It's really odd because there is simply no trace of what could be
> > > killing telnet and ftp...
>
> > > Anyway...thanks again for taking time to read this and keeping my
> > > fingers crossed for an answer....  Please copy any replies to
> > > tden...@airnetcom.com.
>
> > Well -- if you suspect you've been hacked, then "netstat" is likely
> > already compromised.
>
> > The first thing a hacker does upon successful access is to replace
> > various critical programs that might otherwise disclose his
> > clandestine activities.  "netstat", "ps", "ls", "strings", etc. are
> > not be trusted implicitly.
>
> > So if you suspect foul play, you should probably check some of the
> > security oriented newsgroups.
>
> > Hope that's helpful.
>
> Thanks for the advice...I'm just a little suspicious, but I don't see
> why a hacker would just do something so limited, but the security
> forums are a great idea...I'll keep looking both forums:)

It depends on the hacker -- when I go over my httpd logs, I'll
occasionally find errors where the connecting person attempted to run
"C:\WINDOWS\CMD".  Well, that's stupid, even if it was a windows
machine, that old hack has been fixed forever.

There are "root-kits" freely available for download, and the hacker
doesn't need to have any knowledge whatsoever.  He just runs the
sucker against a likely target, and if it finds a vulnerability, it
exploits it automatically.

Our system was hacked with one of those a couple of times, and it was
fairly clear that there was nothing else wrong with the system.
Apparently, once the guy got in, he didn't know what else to do with
it, and abandoned it.  At least, as far as I could tell.  Maybe he
just left upon not finding any pix of naked ladies or credit card
numbers.

Another time we got hacked, and the guy just set himself up a remote
IPC server.  I guess he needed something to bounce around other
system's firewalls.

Don't believe the old hype about how "intelligent" hackers are -- some
of them are just garden variety morons, like your typical thug who
didn't invent the door shim, but learned how to use one.

Best of luck!

On Feb 28, 11:56 pm, tdenham...@gmail.com wrote:

>
> Thanks for the advice...I'm just a little suspicious, but I don't see
> why a hacker would just do something so limited, but the security
> forums are a great idea...I'll keep looking both forums:)

What you're *noticing* is limited.  That doesn't necessarily mean that
what they're *doing* is limited. telnetd falling over every once in a
while might be some tiny side effect of who-knows-what.

--tim

On Feb 28, 11:31 pm, tdenham...@gmail.com wrote:

> I've also rebooted and watch the system for a while while running
> netstat in another window, but I never see any connections come into
> the system or anyone login.

I'd use snoop not netstat - you want to see anything aimed at telnet
or ftp ports, not just open connections.

On Mar 1, 7:34 am, "Tim Bradshaw" <tfb+goo...@tfeb.org> wrote:
> On Feb 28, 11:31 pm, tdenham...@gmail.com wrote:
>
> > I've also rebooted and watch the system for a while while running
> > netstat in another window, but I never see any connections come into
> > the system or anyone login.
>
> I'd use snoop not netstat - you want to see anything aimed at telnet
> or ftp ports, not just open connections.

Thanks for all the replies...this turned out to be what appears as a
worm coming from a single PC on our LAN.  Fortunately snoop paid off
and found the culprit!  Yay!

tdenham735@gmail.com wrote:
> stable.  In the last week however, in.telnet and in.ftp has died sort
> of randomly on all 5 of my servers...and when I reboot telnet and ftp

How do you mean, died?  Are these services being fired out of inetd?
Does the port stop responding, or existing connections drop?  Do they drop
a core file?

-- 
Brandon Hume    - hume -> BOFH.Ca, http://WWW.BOFH.Ca/

On Mar 1, 10:00 am, hume.spamfil...@bofh.ca wrote:
> tdenham...@gmail.com wrote:
> > stable.  In the last week however, in.telnet and in.ftp has died sort
> > of randomly on all 5 of my servers...and when I reboot telnet and ftp
>
> How do you mean, died?  Are these services being fired out of inetd?
> Does the port stop responding, or existing connections drop?  Do they drop
> a core file?
>
> --
> Brandon Hume    - hume -> BOFH.Ca,http://WWW.BOFH.Ca/

They just die...or I should say quit responding...basically you can
still telnet, but the telnet session hangs.  I even tried to HUP inetd
hoping it would help, but simply didn't work.

Turns out that what I thought was a worm however, wasn't a worm...it
was an obscure app that an engineer downloaded and ran on our
production network.  I don't know how or why it affected ONLY Solaris
2.6...but it was very, very strange!

Let me know if you have any specific questions Brandon and I'll be
glad to try to answer:)