Re: [security] Big problem on 2.0.x? (fwd)

Dan Yocum (yocum@fnal.gov)
Thu, 16 Dec 1999 14:28:18 -0600


> The SYN flood message said:
>
> 131.225.55.9 on 131.225.55.98:635
>
> The NFS server is 131.225.55.98. So it's very very unlikely that the NFS

Sorry, I should have clarified. Those were 2 separate problems on 4 separate
boxes.

> NOTE: the 131.225.55.9 is not reliable. The attack could came from
> everywhere in the world. You can trace it only by tracing the routing by
> hand.

I was actually on the client machine trying to mount the dir on the server and
watching the server log fill up with the SYN flood messages, so I can verify
that no spoofing was occuring - it was all me.

>
> >messages. Maybe there's a relation there that's causing the mountd to
> >die as well. I'm not intimately acquainted with the details - I just
> >see the results.
>
> Ok I understand.
>
> IMHO the source of these problems is outside the kernel.

I'd believe that. Likely, these problems will go away when we make our next
distribution release and everyone at the Lab upgrades to the 2.2.x kernel - we
still have over a year before the Tevatron goes into collider mode and we have
real data streaming in. Heck, maybe we'll have 3.0.x by then.

Cheers,
Dan

___________________________________________________________________________
Dan Yocum | Phone: (630) 840-8525
Linux Research and Development | Fax: (630) 840-6345
Computing Division, OSS Dept. | email: yocum@fnal.gov .~. L
Fermi National Accelerator Lab | WWW: www-oss.fnal.gov/~yocum/ /V I
P.O. Box 500 | // \ N
Batavia, IL 60510 | "TANSTAAFL" /( ) U
________________________________|_________________________________ ^`~'^__X_

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/