<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>David Laube&#039;s Blog &#187; Security</title>
	<atom:link href="http://www.dlaube.com/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.dlaube.com</link>
	<description>Every linux user has a /home directory.</description>
	<lastBuildDate>Wed, 28 Feb 2024 17:04:21 +0000</lastBuildDate>
	<language>en-US</language>
		<sy:updatePeriod>hourly</sy:updatePeriod>
		<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=4.0</generator>
<meta xmlns="http://www.w3.org/1999/xhtml" name="robots" content="noindex,follow" />
	<item>
		<title>CentOSplus Kernel RPMS</title>
		<link>http://www.dlaube.com/2010/09/centosplus-kernel-rpms/</link>
		<comments>http://www.dlaube.com/2010/09/centosplus-kernel-rpms/#comments</comments>
		<pubDate>Mon, 27 Sep 2010 18:06:41 +0000</pubDate>
		<dc:creator><![CDATA[admin]]></dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.dlaube.com/?p=367</guid>
		<description><![CDATA[Today I found a server using reiserfs, but to my dismay there weren&#8217;t any patched kernels available that address the MCAST_MSFILTER Compat mode security vulnerability. I compiled my own and I&#8217;m making them available. I&#8217;m making 64bit versions of the 2.6.18-194.11.4.el5 kernel for CentOSplus (version 5) available below: http://files.dlaube.com/centos5-plus/kernel-2.6.18-194.11.4.el5.ayplus.x86_64.rpm http://files.dlaube.com/centos5-plus/kernel-headers-2.6.18-194.11.4.el5.ayplus.x86_64.rpm &#8230;MORE here]]></description>
				<content:encoded><![CDATA[<p>Today I found a server using reiserfs, but to my dismay there weren&#8217;t any patched kernels available that address the MCAST_MSFILTER Compat mode <a href="http://seclists.org/fulldisclosure/2010/Sep/268">security vulnerability</a>. I compiled my own and I&#8217;m making them available.</p>
<p>I&#8217;m making 64bit versions of the 2.6.18-194.11.4.el5 kernel  for CentOSplus (version 5) available below:</p>
<p><a href="http://files.dlaube.com/centos5-plus/kernel-2.6.18-194.11.4.el5.ayplus.x86_64.rpm">http://files.dlaube.com/centos5-plus/kernel-2.6.18-194.11.4.el5.ayplus.x86_64.rpm</a><br />
<a href="http://files.dlaube.com/centos5-plus/kernel-headers-2.6.18-194.11.4.el5.ayplus.x86_64.rpm">http://files.dlaube.com/centos5-plus/kernel-headers-2.6.18-194.11.4.el5.ayplus.x86_64.rpm</a></p>
<p>&#8230;MORE <a href="http://files.dlaube.com/centos5-plus/">here</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.dlaube.com/2010/09/centosplus-kernel-rpms/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Unknown linux rootkit?</title>
		<link>http://www.dlaube.com/2010/04/unknown-linux-rootkit/</link>
		<comments>http://www.dlaube.com/2010/04/unknown-linux-rootkit/#comments</comments>
		<pubDate>Sun, 04 Apr 2010 19:13:17 +0000</pubDate>
		<dc:creator><![CDATA[admin]]></dc:creator>
				<category><![CDATA[Hosting]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.dlaube.com/?p=130</guid>
		<description><![CDATA[Recently noticed a bunch of servers (CentOS 5.2 and CentOS 4.8) with SSH fingerprint mismatches. After poking around, it appears that they had been compromised. chkrootkit and RKhunter found nothing but the suspicious entry in /dev (see below). WARNING: DSA key found for host ourserver.domain.com in /Users/username/.ssh/known_hosts:578 DSA key fingerprint f4:27:d0:32:6b:4c:9f:6e:52:6f:49:dd:19:54:c2:f1. +&#8211;[ DSA 1024]&#8212;-+ &#124; [...]]]></description>
				<content:encoded><![CDATA[<p>Recently noticed a bunch of servers (CentOS 5.2 and CentOS 4.8) with SSH fingerprint mismatches. After poking around, it appears that they had been compromised. chkrootkit and RKhunter found nothing but the suspicious entry in /dev (see below).</p>
<p>WARNING: DSA key found for host ourserver.domain.com<br />
in /Users/username/.ssh/known_hosts:578<br />
DSA key fingerprint f4:27:d0:32:6b:4c:9f:6e:52:6f:49:dd:19:54:c2:f1.<br />
+&#8211;[ DSA 1024]&#8212;-+<br />
|             ..o+|<br />
|         .    o..|<br />
|        * .    .E|<br />
|       + B . . .o|<br />
|        S * o &#8230;|<br />
|       . o = .   |<br />
|        . o +    |<br />
|         o .     |<br />
|                 |<br />
+&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;+</p>
<p>The authenticity of host &#8216;ourserver.domain.com (10.0.0.2)&#8217; can&#8217;t be established<br />
but keys of different type are already known for this host.<br />
RSA key fingerprint is 4c:5f:95:3e:52:08:6c:cd:0f:f8:37:38:3c:dd:bf:56.<br />
Are you sure you want to continue connecting (yes/no)? yes</p>
<p>Affected files:</p>
<div class="wp_syntax">
<div class="code">
<pre class="text" style="font-family: monospace;">/dev/sax
/bin/suidshell
/usr/local/bin/ssh-agent
/usr/local/bin/sftp-server
/usr/local/bin/ssh-agent2
/usr/local/bin/ssh
/usr/local/bin/ssh-add2
/usr/local/bin/ssh-signer
/usr/local/bin/ssh-keygen2
/usr/local/bin/ssh-probe2
/usr/local/bin/ssh-probe
/usr/local/bin/scp
/usr/local/bin/sftp
/usr/local/bin/ssh-chrootmgr
/usr/local/bin/ssh-signer2
/usr/local/bin/sftp2
/usr/local/bin/scp2
/usr/local/bin/ssh-pubkeymgr
/usr/local/bin/ssh-dummy-shell
/usr/local/bin/ssh-add
/usr/local/bin/sftp-server2
/usr/local/bin/ssh-askpass
/usr/local/bin/ssh2
/usr/local/bin/ssh-keygen
/usr/local/sbin/sshd2
/usr/local/sbin/sshd-check-conf
/usr/local/sbin/sshd</pre>
</div>
</div>
<ol> <strong>/usr/local/sbin/sshd2</strong> &#8212; captures login credentials for both root and non-root logins over SSH/SCP/sftp etc and logs to /dev/sax</p>
<p><strong>/bin/suidshell</strong> &#8212; is exactly that, a shell with the suid bit set that instantly gives root access to any unprivileged user!</p>
<p><strong>/dev/sax</strong> &#8212; stores plaintext username and password for root and non-root accounts</ol>
]]></content:encoded>
			<wfw:commentRss>http://www.dlaube.com/2010/04/unknown-linux-rootkit/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
