[SOLARIS]Can somebody help me?

jghos

Hi!
I met a question today.There is a SUN E450 server with Solaris 7 which found out the rpc couldn\'t start and telnet ftp didn\'t work,but other services are ok.why?
There are something about it.


Mar 25 10:43:10 mail unix: pseudo-device: devinfo0
Mar 25 10:43:10 mail unix: devinfo0 is /pseudo/devinfo@0
Mar 25 10:43:11 mail unix: pseudo-device: vol0
Mar 25 10:43:11 mail unix: vol0 is /pseudo/vol@0
Mar 25 10:43:12 mail unix: fd0 at ebus0: offset 14,3023f0
Mar 25 10:43:12 mail unix: fd0 is /pci@1f,4000/ebus@1/fdthree@14,3023f0
Mar 25 10:45:01 mail inetd[143]: rquotad/rpc/udp version 1: rpcb_set: not started
Mar 25 10:45:03 mail automountd[146]: svc_create: cannot register 100099 vers 2 on ticotsord
Mar 25 10:45:03 mail automountd[146]: unable to create service
Mar 25 10:45:42 mail named[150]: unapproved update from [202.107.196.116].3740 for 196.107.202.in-addr.arpa
Mar 25 10:46:01 mail inetd[143]: rquotad/rpc/ticlts version 1: rpcb_set: not started
Mar 25 10:47:14 mail server[375]: svc_tp_create: Could not register prog 300598 vers 1 on udp
Mar 25 10:49:01 mail inetd[143]: rusersd/rpc/udp version 2: rpcb_set: not started
Mar 25 10:49:14 mail server[375]: svc_tp_create: Could not register prog 300598 vers 1 on tcp
Mar 25 10:50:58 mail named[150]: unapproved update from [202.107.196.116].3767 for 196.107.202.in-addr.arpa
Mar 25 10:51:14 mail server[375]: svc_tp_create: Could not register prog 300598 vers 1 on ticlts
Mar 25 10:53:14 mail server[375]: svc_tp_create: Could not register prog 300598 vers 1 on ticotsord
Mar 25 10:55:14 mail server[375]: svc_tp_create: Could not register prog 300598 vers 1 on ticots
Mar 25 10:55:14 mail server[375]: unable to create (DMI2_SERVER, DMI2_SERVER_VERSION) for netpath.
Mar 25 11:01:14 mail named[150]: unapproved update from [202.107.196.116].3793 for 196.107.202.in-addr.arpa

By the way,I find the listeners for ftp and telnet are ok??!!
Can somebody tell me why?
Thanks!

jghos

請大家?guī)蛶兔Π�！謝謝了！

clu65

telnet has nothing to do rpc service, nfs does rely on the rpc service. It looks to me your system has been hacked. Try to run last to see who has been logining lately. Also try to run ldd Path_toInetd/inetd and ldd path_to_in.telnetd/in.telnetd. Try to see compare the lib files with other machine (also runing Solaris and did not have problem).

BTW, is any changes you made lately?

Good Luck.

jghos

I have already restarted system serveral times,so i think last maybe no use. And can you tell me what will do with ldd Path_toInetd/inetd and ldd path_to_in.telnetd/in.telnetd?
Thank you!

clu65

Try \"ldd /usr/sbin/inetd\" and \"ldd /usr/sbin/in.telnetd\" to find out the date and size of the dynamic library used by inetd and in.telnetd. And compare those with other functional Solaris 7 server.

jghos

Yes!You are right!I find the ldd results are different from the normal server. How can i correct it? And how can i protect my server from this kind of hack action?

clu65

Well, if you have a clean backup, restore from the tape. If you are not sure, you have to rebuild the server from the scratch.

Security is very big topic itself. There are many ways to protect your system. FireWall, TCP Wrapper, TripWire, SSH, etc.

At least you should disable telnet and install &configure ssh and TcpWrapper.

jghos

clu65,thank you for your help! You are so nice!