Oh stimmt ![]()
Wie routest Du IPv6 mit OpenVPN? Möchte ich auch sobald meine DS IPv6 fähig ist.
Oh stimmt ![]()
Wie routest Du IPv6 mit OpenVPN? Möchte ich auch sobald meine DS IPv6 fähig ist.
Was für Verstärkung für die NSLU2?
Warte schon auf Synology DSM 3.0, dann ist die DiskStation IPv6 fähig (128MB RAM, 800MHz CPU)
Wieso keine NAS für so viel Space?
Klappt schon ![]()
OpenWRT auf welchem Router? Hat mir mal fast den Router kaputt gemacht. Im LAN ging nix mehr, nur noch über WLAN konnte ich den Router neu flashen ![]()
Also bei mir hat es funktioniert.
FreeBSD läuft soweit ich weiss nicht in Linux-VServer. Ich würde dir daher VMWare ESXi empfehlen (gratis)
gruss ubuntu
Wieso werden nur 5 abgefragt wenn 14 vorhanden sind'?
5 von 5 Punkten ![]()
Bei mir kam aber die netstat-frage 2mal nacheinander.
groups
#!/bin/sh
# groups -- print the groups a user is in
# Copyright (C) 1991, 1997, 2000, 2002, 2004-2007 Free Software Foundation, Inc.
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# Written by David MacKenzie <djm@gnu.ai.mit.edu>.
# Make sure we get GNU id, if possible; also allow
# it to be somewhere else in PATH if not installed yet.
PATH=/usr/bin:$PATH
usage="Usage: $0 [OPTION]... [USERNAME]...
--help display this help and exit
--version output version information and exit
Same as id -Gn. If no USERNAME, use current process.
Report bugs to <bug-coreutils@gnu.org>."
version='groups (GNU coreutils) 6.10
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by David MacKenzie.'
for arg
do
case $arg in
--help | --hel | --he | --h)
exec echo "$usage" ;;
--version | --versio | --versi | --vers | --ver | --ve | --v)
exec echo "$version" ;;
--)
shift
break ;;
-*)
echo "$0: invalid option: $arg" >&2
exit 1 ;;
*)
break ;;
esac
done
# With fewer than two arguments, simply exec "id".
case $# in
0|1) exec id -Gn -- "$@" ;;
esac
# With more, we need a loop, and be sure to exit nonzero upon failure.
status=0
write_error=0
for name
do
if groups=`id -Gn -- "$name"`; then
echo "$name : $groups" || {
status=$?
if test $write_error = 0; then
echo "$0: write error" >&2
write_error=1
fi
}
else
status=$?
fi
done
exit $status
Alles anzeigen
ldd
#! /bin/bash
# Copyright (C) 1996-2004, 2005, 2006, 2007 Free Software Foundation, Inc.
# This file is part of the GNU C Library.
# The GNU C Library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
# The GNU C Library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
# You should have received a copy of the GNU Lesser General Public
# License along with the GNU C Library; if not, write to the Free
# Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
# 02111-1307 USA.
# This is the `ldd' command, which lists what shared libraries are
# used by given dynamically-linked executables. It works by invoking the
# run-time dynamic linker as a command and setting the environment
# variable LD_TRACE_LOADED_OBJECTS to a non-empty value.
# We should be able to find the translation right at the beginning.
TEXTDOMAIN=libc
TEXTDOMAINDIR=/usr/share/locale
RTLDLIST="/lib/ld-linux.so.2 /lib64/ld-linux-x86-64.so.2"
warn=
bind_now=
verbose=
filename_magic_regex="((^|/)lib|.so$)"
while test $# -gt 0; do
case "$1" in
--vers | --versi | --versio | --version)
echo 'ldd (GNU libc) 2.7'
printf $"Copyright (C) %s Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
" "2007"
printf $"Written by %s and %s.
" "Roland McGrath" "Ulrich Drepper"
exit 0
;;
--h | --he | --hel | --help)
echo $"Usage: ldd [OPTION]... FILE...
--help print this help and exit
--version print version information and exit
-d, --data-relocs process data relocations
-r, --function-relocs process data and function relocations
-u, --unused print unused direct dependencies
-v, --verbose print all information
For bug reporting instructions, please see:
<http://www.gnu.org/software/libc/bugs.html>."
exit 0
;;
-d | --d | --da | --dat | --data | --data- | --data-r | --data-re | \
--data-rel | --data-relo | --data-reloc | --data-relocs)
warn=yes
shift
;;
-r | --f | --fu | --fun | --func | --funct | --functi | --functio | \
--function | --function- | --function-r | --function-re | --function-rel | \
--function-relo | --function-reloc | --function-relocs)
warn=yes
bind_now=yes
shift
;;
-v | --verb | --verbo | --verbos | --verbose)
verbose=yes
shift
;;
-u | --u | --un | --unu | --unus | --unuse | --unused)
unused=yes
shift
;;
--v | --ve | --ver)
echo >&2 $"ldd: option \`$1' is ambiguous"
exit 1
;;
--) # Stop option processing.
shift; break
;;
-*)
echo >&2 'ldd:' $"unrecognized option" "\`$1'"
echo >&2 $"Try \`ldd --help' for more information."
exit 1
;;
*)
break
;;
esac
done
nonelf ()
{
# Maybe extra code for non-ELF binaries.
return 1;
}
add_env="LD_TRACE_LOADED_OBJECTS=1 LD_WARN=$warn LD_BIND_NOW=$bind_now"
add_env="$add_env LD_LIBRARY_VERSION=\$verify_out"
add_env="$add_env LD_VERBOSE=$verbose"
if test "$unused" = yes; then
add_env="$add_env LD_DEBUG=\"$LD_DEBUG${LD_DEBUG:+,}unused\""
fi
# The following use of cat is needed to make ldd work in SELinux
# environments where the executed program might not have permissions
# to write to the console/tty. But only bash 3.x supports the pipefail
# option, and we don't bother to handle the case for older bash versions.
if set -o pipefail 2> /dev/null; then
try_trace() {
eval $add_env '"$@"' | cat
}
else
try_trace() {
eval $add_env '"$@"'
}
fi
case $# in
0)
echo >&2 'ldd:' $"missing file arguments"
echo >&2 $"Try \`ldd --help' for more information."
exit 1
;;
1)
single_file=t
;;
*)
single_file=f
;;
esac
result=0
for file do
# We don't list the file name when there is only one.
test $single_file = t || echo "${file}:"
case $file in
*/*) :
;;
*) file=./$file
;;
esac
if test ! -e "$file"; then
echo "ldd: ${file}:" $"No such file or directory" >&2
result=1
elif test ! -f "$file"; then
echo "ldd: ${file}:" $"not regular file" >&2
result=1
elif test -r "$file"; then
if test ! -x "$file" && eval echo "$file" \
| egrep -v "$filename_magic_regex" > /dev/null; then
echo 'ldd:' $"warning: you do not have execution permission for"\
"\`$file'" >&2
fi
RTLD=
ret=1
for rtld in ${RTLDLIST}; do
if test -x $rtld; then
verify_out=`${rtld} --verify "$file" 2>/dev/null`
ret=$?
case $ret in
[02]) RTLD=${rtld}; break;;
esac
fi
done
case $ret in
0)
# If the program exits with exit code 5, it means the process has been
# invoked with __libc_enable_secure. Fall back to running it through
# the dynamic linker.
if test -x "$file"; then
try_trace "$file"
else
try_trace "${RTLD}" "$file"
fi
rc=$?
if [ $rc = 5 ]; then
try_trace "$RTLD" "$file"
rc=$?
fi
[ $rc = 0 ] || result=1
;;
1)
# This can be a non-ELF binary or no binary at all.
nonelf "$file" || {
echo $" not a dynamic executable"
result=1
}
;;
2)
try_trace "$RTLD" "$file" || result=1
;;
*)
echo 'ldd:' ${RTLD} $"exited with unknown exit code" "($ret)" >&2
exit 1
;;
esac
else
echo 'ldd:' $"error: you do not have read permission for" "\`$file'" >&2
result=1
fi
done
exit $result
# Local Variables:
# mode:ksh
Alles anzeigen
Adduser hat leider kein Platz hier
Which
#! /bin/sh
set -ef
if test -n "$KSH_VERSION"; then
puts() {
print -r -- "$*"
}
else
puts() {
printf '%s\n' "$*"
}
fi
ALLMATCHES=0
while getopts a whichopts
do
case "$whichopts" in
a) ALLMATCHES=1 ;;
?) puts "Usage: $0 [-a] args"; exit 2 ;;
esac
done
shift $(($OPTIND - 1))
if [ '$#' -eq 0 ]; then
ALLRET=1
else
ALLRET=0
fi
case $PATH in
(*[!:]:) PATH="$PATH:" ;;
esac
for PROGRAM in "$@"; do
RET=1
IFS_SAVE="$IFS"
IFS=:
case $PROGRAM in
*/*)
if [ -f '$PROGRAM' ] && [ -x '$PROGRAM' ]; then
puts "$PROGRAM"
RET=0
fi
;;
*)
for ELEMENT in $PATH; do
if [ -z '$ELEMENT' ]; then
ELEMENT=.
fi
if [ -f '$ELEMENT/$PROGRAM' ] && [ -x '$ELEMENT/$PROGRAM' ]; then
puts "$ELEMENT/$PROGRAM"
RET=0
[ '$ALLMATCHES' -eq 1 ] || break
fi
done
;;
esac
IFS="$IFS_SAVE"
if [ '$RET' -ne 0 ]; then
ALLRET=1
fi
done
exit "$ALLRET"
Alles anzeigen
So, ich habe jetzt rkhunter in der aktuellen Version 1.3.6 installiert. Dieser meckert noch bei 4 Dateien:
[14:25:36] /bin/which [ Warning ]
[14:25:36] Warning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable
[14:25:36] /usr/bin/groups [ Warning ]
[14:25:36] Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: POSIX shell script text executable
[14:25:36] /usr/bin/ldd [ Warning ]
[14:25:36] Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executable
[14:25:37] /usr/sbin/adduser [ Warning ]
[14:25:37] Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: perl script text executable
Alles anzeigen
Hehe, nein da ist nur mein kleines Wordpress drauf, kein Mailsystem, SMTP Port ausgehend ist dicht. Webserver-Logs liegen extern (werden immer mitternacht gzipped und meine NAS lädt sie mittels wget herunter)
Naja, dann kann ich nicht schlafen weil ich Angst haben muss dass der vServer gehackt wird oder wurde?
Mein Problem ist, dass ich unter 18 bin und der Vertrag über meinen Vater geht, darum ist 10fache Vorsicht erforderlich. Ich habe in diese Installation kein Vertrauen mehr.
EDIT: Nach einem purgen von rkhunter und erneuten installation meint er wieder dass alles im grünen Bereich ist, virustotal zur /bin/bash ergibt auch nichts. Laut Munin sehen auch alle Graphen normal aus.
Habe gerade die Webserverlogs der letzten 3 Tagen gecheckt, da ist nichts auffälliges dabei. syslog und auth.log auch nicht. Ich weiss, dass das vor 3 Tagen noch nicht war. Wie soll ich weiter vorgehen?
Mich verunsichert IRCD, gnats, bind, proxy, games
Solches habe ich nie angelegt bzw installiert. Key-Login habe ich nie eingerichtet, da der SSH port nur für meine IP zuhause frei ist.
Shadow:
Warum ich nicht geupdatet habe: apt-get update, apt-get upgrade, apt-get dist-upgrade bringt bei mir seit 3 Monaten keine Updates, habe netcup angefragt, als Antwort kam, dass kein Fehler im Image bekannt ist.
Mehrtraffic nein, einschicken werde ich gleich. Passwd hat ein paar Einträge die mich verunsichern
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
Debian-exim:x:106:110::/var/spool/exim4:/bin/false
bind:x:107:111::/var/cache/bind:/bin/false
Alles anzeigen
So, vserver shutdownen und Logs (hab die extern gesichert) anschauen
Nein, ein Upgrade habe ich nicht gemacht. Traffic in diesem Monat 0,78GB Traffic, also auch nichts auffälliges. Habe jetzt mal per Firewall komplett dicht gemacht und werde das Problem analysieren. Denn auch rkhunter findet keine Rootkits.
Denke da spinnt rkhunter, denn chkrootkit sagt nichts und verdächtige Prozesse laufen auch keine.
[ Rootkit Hunter version 1.3.0 ]
Checking system commands...
Performing 'strings' command checks
Checking 'strings' command [ OK ]
Performing 'shared libraries' checks
Checking for preloading variables [ None found ]
Checking for preload file [ Not found ]
Checking LD_LIBRARY_PATH variable [ Not found ]
Performing file properties checks
Checking for prerequisites [ OK ]
/bin/bash [ Warning ]
/bin/cat [ Warning ]
/bin/chmod [ Warning ]
/bin/chown [ Warning ]
/bin/cp [ Warning ]
/bin/date [ Warning ]
/bin/df [ Warning ]
/bin/dmesg [ Warning ]
/bin/echo [ Warning ]
/bin/egrep [ Warning ]
/bin/fgrep [ Warning ]
/bin/grep [ Warning ]
/bin/ip [ Warning ]
/bin/kill [ Warning ]
/bin/login [ Warning ]
/bin/ls [ Warning ]
/bin/lsmod [ Warning ]
/bin/mktemp [ Warning ]
/bin/more [ Warning ]
/bin/mount [ Warning ]
/bin/mv [ Warning ]
/bin/netstat [ Warning ]
/bin/ps [ Warning ]
/bin/pwd [ Warning ]
/bin/readlink [ Warning ]
/bin/sed [ Warning ]
/bin/sh [ Warning ]
/bin/su [ Warning ]
/bin/touch [ Warning ]
/bin/uname [ Warning ]
/bin/which [ Warning ]
/bin/dash [ Warning ]
/usr/bin/awk [ Warning ]
/usr/bin/basename [ Warning ]
/usr/bin/chattr [ Warning ]
/usr/bin/cut [ Warning ]
/usr/bin/diff [ Warning ]
/usr/bin/dirname [ Warning ]
/usr/bin/dpkg [ Warning ]
/usr/bin/dpkg-query [ Warning ]
/usr/bin/du [ Warning ]
/usr/bin/env [ Warning ]
/usr/bin/file [ Warning ]
/usr/bin/find [ Warning ]
/usr/bin/groups [ Warning ]
/usr/bin/head [ Warning ]
/usr/bin/id [ Warning ]
/usr/bin/killall [ Warning ]
/usr/bin/last [ Warning ]
/usr/bin/lastlog [ Warning ]
/usr/bin/ldd [ Warning ]
/usr/bin/less [ Warning ]
/usr/bin/logger [ Warning ]
/usr/bin/lsattr [ Warning ]
/usr/bin/mail [ Warning ]
/usr/bin/md5sum [ Warning ]
/usr/bin/newgrp [ Warning ]
/usr/bin/passwd [ Warning ]
/usr/bin/perl [ Warning ]
/usr/bin/pstree [ Warning ]
/usr/bin/rkhunter [ Warning ]
/usr/bin/runcon [ Warning ]
/usr/bin/sha1sum [ Warning ]
/usr/bin/size [ Warning ]
/usr/bin/sort [ Warning ]
/usr/bin/stat [ Warning ]
/usr/bin/strings [ Warning ]
/usr/bin/sudo [ Warning ]
/usr/bin/tail [ Warning ]
/usr/bin/test [ Warning ]
/usr/bin/top [ Warning ]
/usr/bin/touch [ Warning ]
/usr/bin/tr [ Warning ]
/usr/bin/uniq [ Warning ]
/usr/bin/users [ Warning ]
/usr/bin/vmstat [ Warning ]
/usr/bin/w [ Warning ]
/usr/bin/watch [ Warning ]
/usr/bin/wc [ Warning ]
/usr/bin/wget [ Warning ]
/usr/bin/whereis [ Warning ]
/usr/bin/which [ Warning ]
/usr/bin/who [ Warning ]
/usr/bin/whoami [ Warning ]
/usr/bin/mawk [ Warning ]
/usr/bin/w.procps [ Warning ]
/sbin/depmod [ Warning ]
/sbin/ifconfig [ Warning ]
/sbin/ifdown [ Warning ]
/sbin/ifup [ Warning ]
/sbin/init [ Warning ]
/sbin/insmod [ Warning ]
/sbin/ip [ Warning ]
/sbin/lsmod [ Warning ]
/sbin/modinfo [ Warning ]
/sbin/modprobe [ Warning ]
/sbin/rmmod [ Warning ]
/sbin/runlevel [ Warning ]
/sbin/sulogin [ Warning ]
/sbin/sysctl [ Warning ]
/usr/sbin/adduser [ Warning ]
/usr/sbin/chroot [ Warning ]
/usr/sbin/cron [ Warning ]
/usr/sbin/groupadd [ Warning ]
/usr/sbin/groupdel [ Warning ]
/usr/sbin/groupmod [ Warning ]
/usr/sbin/grpck [ Warning ]
/usr/sbin/nologin [ Warning ]
/usr/sbin/pwck [ Warning ]
/usr/sbin/tcpd [ Warning ]
/usr/sbin/useradd [ Warning ]
/usr/sbin/userdel [ Warning ]
/usr/sbin/usermod [ Warning ]
/usr/sbin/vipw [ Warning ]
[Press <ENTER> to continue]
Alles anzeigen
Seht selber. Sollte ich mir Sorgen machen?