Re: SGI/O2 trouble----May affect you too!

rnunlist@calmarc6.cchem.berkeley.edu
Mon, 6 Dec 1999 14:21:34 -0800 (PST)

Looks like your systems' security might have been compromised. You might
want to consult your computer (- security) experts, some other systems
might have been affected as well.
If it was a compromise, you probably want to re-install IRIX asap, and
add the recommended security patches.

In addition, you might want to consider removing un-necessary network
services, and adding tcp_wrappers and ssh.

A recently popular exploit is a hole in autofs. Sgi released a patch in
November 98 for IRIX versions 6.2 to 6.5.1.
See ftp://sgigate.sgi.com/security/19981005-01-PX

Rudi

----------------------------------
On 6 Dec, Xinfeng Gao wrote:
= Dear Bruker Users,
=
= We have two SGI/O2 operating pm Irix 6.3. On Nov 30 at exactly the same
= time (18:02) they both have the "su" password protection turned off. So
= anyone can get to super user mode without a root password. we found out
= that a file called .rhost containing two + signs was added under /. After
= deleting the file "su" works normal (will ask password) again. This may
= affect anyone who has a O2 if the problem is caused by some system bug. We
= know another O2 in our campus having the same problem starting at the same
= time.
=
= Another problem may be related to the first one: the SYSLOG file is now
= constantly adding this line
= "bootp [16713]: DHCP request, server not configured. exiting."
=
= Have anyone got this problem also? If you have how have you solved it?
=
= Thanks,
=
= Wei
= 

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Rudi Nunlist              Voice: (510) 642-6407  FAX: (510) 642-8369
University of California  Email:   nmrlab@purcell.cchem.berkeley.edu
College of Chemistry 
NMR Facility
Berkeley, CA 94720-1460   Personal email: rnunlist@purcell.cchem.berkeley.edu


 www.cchem.berkeley.edu/College/Facilities/nmr
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=