I'm very concerend that my Astaro 5.103 box has been hacked.
It appears that my HTTP proxy service has been compromised but I wanted more experienced users input on this matter.
It looks like my internal machine at address 1.5 was getting harrassed, then the source of the attack changed to the address of my permimter firwall , the Astaro box [v5.103].
This looks like a successful hack of Astaro Security Linux.
Can someone confirm?
Please examine the following log entries:
Local logfile query Query term: DOS Time span: 2005-03-01 -> 2005-03-02
Intrusion Protection System
2005:03:01-12:32:10 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:01-12:32:13 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:01-12:32:19 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:01-12:32:31 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:01-12:32:55 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:01-12:33:43 (none) snort[913]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 208.254.45.206:443 -> 10.1.1.5:3372
2005:03:02-12:49:59 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:49:59 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:49:59 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:00 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:01 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:02 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:06 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:12 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:26 (none) snort[2751]: [1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of Service] [Priority: 2]: {PROTO006} 10.1.1.2:8081 -> 10.1.1.5:3372
2005:03:02-12:50:53 (none) snort[2751]: [1:140 ...
PS: i originally posted this in the wrong place... sorry]
This thread was automatically locked due to age.
