Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down.

Are there any log files we can look at to see evidence of this? We don't have access to their tools or logs.

(We're a tad suspicious of the claim of the attack because the claim involved two windows servers and the Gentoo box that all allegedly got a virus that did something to overload the whole network. They have been wanting the services we ran on these boxes for themselves for a year or more. They presented no evidence of the attack and this post is me trying to find evidence on the box myself).

share|improve this question

migrated from stackoverflow.com Oct 8 '09 at 22:47

This question came from our site for professional and enthusiast programmers.

2 Answers 2

You've got a couple of options on how in depth you want to get into this.

  1. Take the server completely offline, boot one of the forensics boot disks and start looking for anything that changed that might be the actual OS. /usr/bin/ /usr/lib /etc/ /sbin and obviously ignore /usr/portage.

  2. install rkhunter and run it. If the box is severely compromised it may not find anything, but it's worth a shot.

  3. Packet sniff the ethernet port of the Gentoo server from another machine, you'll need access to the switch and a managed switch to do this correctly. You can try sniffing from the machine itself, but again if it's severely compromised you might not see anything.

  4. If you control a firewall between your server and theirs try adding some permit rules on the RPC ports with logging.

Assuming you still think the problem is actually on the other end, call a meeting. Ask for application logs, errors, system logs, etc. Take the whole thing seriously. Way seriously. If your server has been compromised then theirs might be too and they have to completely rebuild their machines. All of them. Unless somehow we can figure out what really happened. The threat of a full system reinstall is usually enough to make people cough up what really happened, but tailor this to your actual political capital, groups, etc. Sucks, but sometime politics has to be played. May as well play it well.

Lastly, if your Gentoo machine has been compromised you'll have to rebuilt it from scratch. Even taking it offline, chrooting and running emerge -e world won't clean it up.

share|improve this answer
1  
+1 for politics. If you're suspicious of what's REALLY going on and you think its all a hoax then definitely treat it WAY serious and make life a little uncomfortable for them just to see if they'll squirm or fess up to what really happened. –  KPWINC Oct 8 '09 at 23:25
    
+2 for politics. To indicate your server did something wrong yet provide no evidence (even questionable evidence) is unacceptable; go on the offensive and get answers. –  troyengel Oct 8 '09 at 23:48
    
+3 for politics. Let them have the servers & services. Then when something really goes wrong with them, you can say "Man, am I glad I don't have to deal with that mess any more..." –  Joe Internet Oct 9 '09 at 6:51

iptables supports logging (-j LOG). I've used it both for debugging firewall rules and for DoS detection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.