On Mon, 28 Jul 1997, Vincent Poy wrote:

In this case, the chances are he just inserted some dud DNS entries, or simply set his in-addr.arpa to something nasty. There's nothing one can do to prevent an authoritative name entry (trash or not) from being accepted in DNS or DNSsec. One thing I would like to see is logging of IP address *and* hostname in the logs. Both are useful, depending on the situation. Due to the nature of TCP, IP addresses are fairly useful in tracing an attack, but often, especially after a time delay, hostnames are the only way to easily contact the maintainer of the IP address. Hostname is also more useful in spotting attacks in the first place, as it's easy for a user to tell when they've logged in from somewhere they haven't :).

BTW, does anyone know if there is a secure logging protocol? Syslog on UDP seems a tad unreliable, not to mention opening one up from DoS. I log to a loghost, and that machine could easily suffer DoS from log flooding, etc. A simple signature arrangement using MD5 (HMAC?) similar to DNS TSIG would be easy enough to arrange, and far more secure. I assume someone, somewhere has written one, or implemented one, but I haven't been following the Internet Draft releases to closely.

I'd be tempted to look in all the normal places -- sendmail, etc. What daemons were running on the machine? Any web server processes? Also, I'd heavily suspect that he sniffed a password if no encrypted telnet/ssh is in use.. Any use of NIS going on? Also, .rhosts arrangements can be extremely unhappy if we already know (s)he is messing with DNS entries.