16

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are:

# iptables -A OUTPUT -d [mySmtpSmarthost]/32 -p tcp -m tcp --dport 25 -j ACCEPT
# iptables -A OUTPUT -d [mySmtpSmarthost]/32 -p tcp -m tcp --dport 465 -j ACCEPT
# iptables -A OUTPUT -d [mySmtpSmarthost]/32 -p tcp -m tcp --dport 587 -j ACCEPT
# iptables -A OUTPUT -p tcp -m tcp --dport 25 -j LOG
# iptables -A OUTPUT -p tcp -m tcp --dport 465 -j LOG
# iptables -A OUTPUT -p tcp -m tcp --dport 587 -j LOG
# iptables -A OUTPUT -p tcp -m tcp --dport 25 -j DROP
# iptables -A OUTPUT -p tcp -m tcp --dport 465 -j DROP
# iptables -A OUTPUT -p tcp -m tcp --dport 587 -j DROP

The goal here is to catch anything suspect, mainly rogue PHP scripts that connect directly to some hacked (SMTP?) server out there. There is a Exim mail server on localhost which hands off messages to external smarthost, so that the WordPress wp_mail() function works, with the help of a SMTP plugin that configures it to use localhost as SMTP server.

In other words, I'm saying: "dear rogue script, either you use the configured smarthost (so that I can bust you there) or you are already busted here".

That obviously assumes the server hasn't been hacked to the root... and here comes my question.

Yesterday I found this in the logs:

Nov 21 12:23:55 web kernel: [35501.571711] IN= OUT=eth0 SRC=my.server.public.ip DST=109.89.132.126 \
  LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=81 DPT=587 WINDOW=0 RES=0x00 ACK RST URGP=0
                                                     ^^^^^^ This!

while

# netstat -nltp | grep :81
#

so I deduce that something managed to bind port 81 on the locally configured public IP address and tried to send a message to 109.89.132.126 on port 587.

Is that at all possible without having root privileges? Port 81 is lower than 1024, i.e. it's a privileged port on Linux, and I've never issued any custom setcap command on this server.

  • 7
    Title is vague. Edit to summarize your particular technical concern. – Basil Bourque Nov 23 '20 at 1:45
  • 2
    Reassure yourself sudo lsof -i | grep -i listen to list all the ports that have servers behind them. – waltinator Nov 23 '20 at 23:20
49
... SRC=my.server.public.ip DST=109.89.132.126 ...
... PROTO=TCP SPT=81 DPT=587 ... RST ... 

This is a RST. It will be generated by your server if a remote system (in this case 109.89.132.126) tries to connect to a port on your system where no one is listening. Given that no one is listening on port 81 on your system it is sufficient that 109.89.132.126 has send a packet with source port 587 to your system port 81.

In other words: there is no need to hack your system in order to cause this log message.

  • 1
    And a stateful firewall would have passed the RST back and not bothered the user about it, or just dropped the SYN in the first place. – Michael Hampton Nov 22 '20 at 22:46
  • 1
    @MichaelHampton: For dropping the incoming SYN no stateful firewall would be needed, stateless is sufficient. iptables (which is used here) is of course already a firewall (even a stateful) one. Only the user seems to have no rules to drop incoming connection attempts (at least not to port 81). So just deploying the firewall is not sufficient, it has to be deployed with the appropriate rules. – Steffen Ullrich Nov 23 '20 at 6:54
  • I recall being able to in iptables rules say something like only log SYN packets. Would be a great help here. – Joshua Nov 23 '20 at 20:06
  • 1
    While this doesn't suggest that the system is hacked, it could mean someone is trying to break in. – Barmar Nov 24 '20 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.