AFP548 Changing the world one server at a time.

Any security experts here?

Home › Forums › OS X Server and Client Discussion › Questions and Answers › Any security experts here?

  • This topic is empty.
Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • May 22, 2006 at 3:13 pm #366236
    Anonymous
    Guest

    Last week I noticed that ARD was displaying our Xserve as ‘access denied’. Strange, I thought, so I tried logging in via WGM but the password was incorrect. Luckily I had another user set up with admin access, so I was able to log in using that account. When I looked at the Password Service log in Library/Logs I found this:

    — Start: Server rolled log on: May 12 2006 13:24:31 —
    May 12 2006 13:24:32 RSAVALIDATE: success.
    May 12 2006 13:24:32 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism MS-CHAPv2.
    May 12 2006 13:24:32 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:24:32 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:26:41 RSAPUBLIC: ok
    May 12 2006 13:26:41 RSAVALIDATE: success.
    May 12 2006 13:26:41 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:26:41 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:26:41 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:26:42 RSAPUBLIC: ok
    May 12 2006 13:26:42 RSAVALIDATE: success.
    May 12 2006 13:26:42 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:26:42 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:26:42 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:26:43 RSAPUBLIC: ok
    May 12 2006 13:26:43 RSAVALIDATE: success.
    May 12 2006 13:26:43 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DHX.
    May 12 2006 13:26:43 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:26:44 RSAPUBLIC: ok
    May 12 2006 13:26:44 GETDISABLEDUSERS
    May 12 2006 13:26:44 GETDISABLEDUSERS
    May 12 2006 13:26:48 RSAPUBLIC: ok
    May 12 2006 13:26:48 GETPOLICY: user {0x00000000000000000000000000000001, admin}, policies: isDisabled=0 isAdminUser=1 newPasswordRequired=0 usingHistory=0 canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0 requiresAlpha=0 requiresNumeric=0 expirationDateGMT=4294967295 hardExpireDateGMT=4294967295 maxMinutesUntilChangePassword=0 maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0 minChars=0 maxChars=0 passwordCannotBeName=0 isSessionKeyAgent=0
    May 12 2006 13:26:48 QUIT: {no user} has disconnected.
    May 12 2006 13:27:03 CHANGEPASS: could not add kerberos principal.
    May 12 2006 13:27:03 CHANGEPASS: {0x00000000000000000000000000000001, admin} changed password for user {0x00000000000000000000000000000001, admin}
    May 12 2006 13:27:07 QUIT: {no user} has disconnected.
    May 12 2006 13:27:07 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:26 RSAPUBLIC: ok
    May 12 2006 13:27:26 RSAVALIDATE: success.
    May 12 2006 13:27:26 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:26 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:27:26 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:27 RSAPUBLIC: ok
    May 12 2006 13:27:27 RSAVALIDATE: success.
    May 12 2006 13:27:27 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:27 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:27:27 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:28 RSAPUBLIC: ok
    May 12 2006 13:27:28 RSAVALIDATE: success.
    May 12 2006 13:27:28 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DHX.
    May 12 2006 13:27:28 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:27:28 RSAPUBLIC: ok
    May 12 2006 13:27:28 GETDISABLEDUSERS
    May 12 2006 13:27:28 GETDISABLEDUSERS
    May 12 2006 13:27:37 QUIT: {no user} has disconnected.
    May 12 2006 13:27:37 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:49 RSAPUBLIC: ok
    May 12 2006 13:27:49 RSAVALIDATE: success.
    May 12 2006 13:27:49 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:49 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:49 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:51 RSAPUBLIC: ok
    May 12 2006 13:27:51 RSAVALIDATE: success.
    May 12 2006 13:27:51 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:51 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:51 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:51 RSAPUBLIC: ok
    May 12 2006 13:27:51 RSAVALIDATE: success.
    May 12 2006 13:27:51 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:51 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:51 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:52 RSAPUBLIC: ok
    May 12 2006 13:27:52 RSAVALIDATE: success.
    May 12 2006 13:27:52 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:52 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:52 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:52 RSAPUBLIC: ok
    May 12 2006 13:27:52 RSAVALIDATE: success.
    May 12 2006 13:27:52 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:52 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:52 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:53 RSAPUBLIC: ok
    May 12 2006 13:27:53 RSAVALIDATE: success.
    May 12 2006 13:27:53 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:53 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:53 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:27:53 RSAPUBLIC: ok
    May 12 2006 13:27:53 RSAVALIDATE: success.
    May 12 2006 13:27:53 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:27:53 AUTH2: {0x00000000000000000000000000000001, admin} authentication failed, SASL error -13.
    May 12 2006 13:27:53 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:28:02 RSAPUBLIC: ok
    May 12 2006 13:28:02 RSAVALIDATE: success.
    May 12 2006 13:28:02 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:28:02 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:28:02 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:28:02 RSAPUBLIC: ok
    May 12 2006 13:28:02 RSAVALIDATE: success.
    May 12 2006 13:28:02 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DIGEST-MD5.
    May 12 2006 13:28:02 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:28:02 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 13:28:03 RSAPUBLIC: ok
    May 12 2006 13:28:03 RSAVALIDATE: success.
    May 12 2006 13:28:03 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism DHX.
    May 12 2006 13:28:03 AUTH2: {0x00000000000000000000000000000001, admin} authentication succeeded.
    May 12 2006 13:28:04 RSAPUBLIC: ok
    May 12 2006 13:28:04 GETDISABLEDUSERS
    May 12 2006 13:28:04 GETDISABLEDUSERS
    May 12 2006 13:28:34 RSAPUBLIC: ok
    May 12 2006 13:28:34 GETPOLICY: user {0x00000000000000000000000000000001, admin}, policies: isDisabled=0 isAdminUser=1 newPasswordRequired=0 usingHistory=0 canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0 requiresAlpha=0 requiresNumeric=0 expirationDateGMT=4294967295 hardExpireDateGMT=4294967295 maxMinutesUntilChangePassword=0 maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0 minChars=0 maxChars=0 passwordCannotBeName=0 isSessionKeyAgent=0
    May 12 2006 13:28:34 QUIT: {no user} has disconnected.
    May 12 2006 13:28:37 RSAPUBLIC: ok
    May 12 2006 13:28:37 GETPOLICY: user {0x00000000000000000000000000000001, admin}, policies: isDisabled=0 isAdminUser=1 newPasswordRequired=0 usingHistory=0 canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0 requiresAlpha=0 requiresNumeric=0 expirationDateGMT=4294967295 hardExpireDateGMT=4294967295 maxMinutesUntilChangePassword=0 maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0 minChars=0 maxChars=0 passwordCannotBeName=0 isSessionKeyAgent=0
    May 12 2006 13:28:52 QUIT: {no user} has disconnected.
    May 12 2006 13:28:52 QUIT: {no user} has disconnected.
    May 12 2006 13:28:52 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 12 2006 14:46:57 RSAPUBLIC: ok
    May 12 2006 14:46:57 RSAVALIDATE: success.
    May 12 2006 14:46:57 AUTH: {0x00000000000000000000000000000001, admin} requested mechanism MS-CHAPv2.
    May 12 2006 14:46:57 QUIT: {0x00000000000000000000000000000001, admin} has disconnected.
    May 15 2006 13:42:28 RSAVALIDATE: success.
    — End: Server rolled log on: May 15 2006 13:42:28 —

    A few other facts that might be relevant. I’m trialling a VPN router and was logging into this from home on that day. Could I somehow have hacked into my own server and changed the admin password? Seems highly unlikely to me. Also, the next day a consultant who we use to look after our web server turned up at the office telling everyone about his new business project – ethical hacking. He offers to test a companies network security. Coincidence?

    I searched these forums and someone advised checking /var/log/asl.log that stores access times and IP addresses, but I could not find this log (I am running 10.3.9) could it have been deleted? If so, is there a log of file deletions?

    I’m trying to work out if we have been hacked, or if I have screwed things up testing VPN or what.

    Any advice would be most welcome.

    Thanks

    May 24, 2006 at 8:19 am #366254
    Anonymous
    Guest

    Thanks for the link macshome. Interesting to note that DNS will affect things. I was also messing with the DNS settings to fix a problem with the mailserver running on the same Xserve. Perhaps in changing the DNS config, I directed my test VPN traffic to the wrong device? My knowledge of DNS is a bit sketchy, so I could well have done something stupid here!

    Oh well, put it down to experience, at least it’s drawn my attention to the security holes on our network.

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.