Re: exploit or human

From: Kevin Reardon (Kevin.Reardon_at_oracle.com)
Date: 03/30/05

  • Next message: Ben Nelson: "Re: exploit or human" 
    Date: Wed, 30 Mar 2005 07:18:01 -0800
To: incidents@securityfocus.com

    Is it possible that you bought the servers at the same time from the
    same manufacturer? It looks like you have a corrupt disk and if all
    those hard drives came out of the same batch, it is very possible to
    have "the same problem" on the different servers. When you say "can't
    do ssh on it" at what point in the ssh process does it fail? Do you get
    prompted to put in the user name and password and then it hangs? This
    could be due to the user home disk being corrupted and the login scripts
    are not being able to run. It may have nothing to do with ssh or the
    system being compromised. It really looks like you bought a bunch of
    disks at the same time and they are lemons or really, really old, got
    too hot, etc. I've had disk problems spread throughout a building and
    the cause turned out to be low city electrical power being delivered to
    the building.

    ---K

    andrew2@one.net wrote:

    >Are you up to date on the RedHat Kernel? I seem to recall there being a
    >kernel bug in RedHat 7.3 for ext3 filesystems that was resolved with an
    >updated kernel ~2 years ago.
    >
    >Andrew
    >
    >Cristian Stanca wrote:
    >
    >
    >>Hello,
    >>
    >>We've got a hard disk failure (bad blocks - reported the
    >>array controller
    >>bios) on a scsi hard-disk on an INTEL platform (running
    >>Fedora Core 2 Linux operating system). What is interesting is
    >>that this hard-disk failure occurred after a "I don't know
    >>what it is... let's reboot it and see after that" situation.
    >>Situation describe by many "segmentation fault" when using
    >>typical application like vi or service or even grub-install.
    >>Grub did not start again after that (we tried to reinstall it
    >>with an Install CD 1 from Fedora and grub-install did said
    >>"segmentation fault" again)
    >>
    >>We did recover the data on that scsi hard-drive by mounting
    >>it on another machine.
    >>
    >>So far so good (sort of)
    >>
    >>After a week or so, another Linux server, began to show the
    >>same errors while giving shell commands and also sshd
    >>listened on port 22 we cannot do a ssh on it. We did not make
    >>the connection to the previous case (as we thought was a
    >>possible hardware failure), reboot it and grub did not start.
    >>We boot again with an install CD from redhat 7.3 (as we had
    >>redhat 7.3 installed on that hard-disk, and thought if any
    >>files are missing...), the hard-disk was recognized by
    >>controller (again scsi hard-disk), fdisk view the partitions,
    >>and cannot this time mount them. (As I write this the "much
    >>more important data that hardware" hard-disk is at a computer
    >>service, for data recovery.
    >>
    >>Again, on a third Linux server (redhat 7.3) we got some
    >>messages at the primary console (kernel BUG commit.c #some
    >>number, lots of stack text and hexa symbols...) and again
    >>can't do ssh on it (it responds to ping and traceroute,
    >>telnet ip_address port 22 works...). We are kind of worried
    >>regarding the reboot of this machine...
    >>
    >>Could that be a worm, exploit or something, or looks like a
    >>human intervention situation?!
    >>
    >>
    >>In the mean time, we are working at a firewall and password policies.
    >>
    >>
    >
    >
    >
    >

  • Next message: Ben Nelson: "Re: exploit or human"

    Relevant Pages

    • Analysis of SSH crc32 compensation attack detector exploit
      ... Analysis of SSH crc32 compensation attack detector exploit ... detector vulnerability to remotely compromise a Red Hat Linux ... Active Internet connections (servers and established) ...
      (Incidents)
    • Re: How to verify/fix High Disk Read Latencies in Exch2003 ?
      ... Exchange production servers are, the SAN is an EMC CX600. ... >>> current log file on disk and continues until data in the log buffers ... Comingling occurs whe two or more LUNs reside ...
      (microsoft.public.exchange.admin)
    • Re: Agent Forwarding Question for the list
      ... I provided a suggestion (invoking ssh with -vvv) as to how to further troubleshoot the problem. ... I was determined to ask the experts in case it was a common mistake or something that simply is not possible under openssh. ... Say in the ideal setup for development servers I'd have a cronuser, scriptuser, monitoruser, cvsuser, and root all configured with my public key and that I could jump in and out of each not only from my own Linux Desktop, but through each user to each user on other servers in the development chain. ... After reading all the documentation and FAQs I could find, I had assumed ssh-agent on the desktop and agent forwarding on the servers would be sufficient, but something is blocking the forwarding, or I'm way off and this isn't how it's meant to work. ...
      (SSH)
    • Re: 2003 Enteprise SP2 or 2003 Enteprise R2
      ... If you run setup from disk 2 of the R2 set it will install this: ... SP 2 on *all* Win 2k3 servers. ... SP 2 is an OS upgrade that should be ...
      (microsoft.public.windows.server.general)
    • Re: create a SSH connection without password WITH EXPECT
      ... connection by ssh on a distant server but it doesnt work. ... from every servers on a single syslog daemon. ... set Host [lindex $argv 0] ...
      (comp.lang.tcl)