1

I have, what I hope, is a fairly secure internet set up. My AT&T U-verse modem goes directly into a pfSense hardware firewall. I wanted to set up an FTP site for a friend to download some files, so I put a Raspberry Pi connected directly to the U-verse modem and had the modem redirect a random port to the Pi's standard FTP port. I have only two logins on the Pi, one for him and one for me.

I figure that sticking this Pi out there was no big deal, even if someone could get onto it, all it had was some books on it, and no way to get around the hardware firewall.

Some weeks later tho, I started noticing my Internet connection getting flaky - very often when attempting to bring up a web page there'd be a DNS failure, connections themselves were very slow to start. On a hunch, I disconnected the Pi and instantly cleared up and I haven't had a dns failure since. Hmmm.

Does the Pi keep any logs of what might have been happening to it? Obviously it was being subjected to some kind of attack, but what? And who? thanks, Larry

| improve this question | |
  • Do you really need to know specifically what happened? That may be time consuming and potentially expose you to new risks. You seem sure you were hacked and that seems likely. The disruptive part would have been that the hacker wasn't downloading the content that you put on your Pi but was rather using your Pi as a server of some sort for their own purposes. By putting this outside your firewall, you probably kept the rest of your home network protected, but they were still using your bandwidth for their purposes - enough that you noticed it. I suggest forget the logs and re-flash the card. – Brick Mar 18 '18 at 13:43
  • Knowing what happened might provide insight on how to avoid it. I'd really like to make this available to my friend. I perhaps can toughen up the Pi, but if it was getting beat to death with some sort of penetration barrage, then what it does to my legit traffic isn't worth it. I'd just like to know what was really going on. – LarryM Mar 18 '18 at 18:12
1

You didn't say which OS you're running, but in general, all unix/linux system logs are located in the /var/log/ directory and sub directories.

If you do an "ls -l /var/log" you'll see a multitude of log files. Most of the log file names are self explanatory. In general, the *.log files are readable via 'more' or via your favorite texteditor/viewer. And some application specific logs may be in application-named subdirectories.

As for your slow network response and DNS failures: Most DNS runs via UDP. If you had a rogue process throwing out a lot of UDP packets, they could be getting dropped at your router/modem and/or your ISP's routers. This would account for the DNS failures and Web problems. Most webpages require a multitude of DNS lookups and if DNS fails or is slow, your web page loads will also be slow...

| improve this answer | |
  • Standard PI, that's why I posted here. I'll look at the logs, but I'm pretty sure whatever they contain won't have much (any?) meaning to me. I don't know what to look for. – LarryM Mar 18 '18 at 18:14
  • From "raspberrypi.org/help/faqs/#softwareOS" : "There are several official distributions (distros) available on our downloads page. New users will probably find the NOOBS installer the easiest to work with, as it walks you through the download and installation of a specific distro. The recommended distro is Raspbian..." So: You are probably using "Raspian" as it's the default NOOBS install. :-) – user83536 Mar 18 '18 at 18:18
  • Yes. I thought it was the only "general purpose" one. The others, OSMC, Open-ELEC... were specific (KODI) releases. But yes, standard as could be, off the shelf Raspian. – LarryM Mar 18 '18 at 21:21
  • Currently what text log files still exist in /var/log depends on how how things are configured. As of v.8, the primary logger is no longer rsyslog, it's journald, a systemd daemon. Rsyslog is not incompatible with this, but it now receives stuff via journald. I think Debian/Raspbian are keeping thing such that most stuff still ends up in var/log text files (although this may be less so in v.9), but journald's own logs aren't text; to read them you need to use journalctl (see man journalctl. – goldilocks♦ Mar 19 '18 at 12:49
-2

FTP

facepalm

clears throat

Never, ever, EVER use FTP.

Why? Because FTP uses absolutely zero encryption. Files are sent over unencrypted, PASSWORDS are sent over unencrypted, and FTP credentials are stored on the local machine (~/.netrc) unencrypted, which everyone with read access can see. It's an outdated standard from the 70s based on the trust system, which is just begging to be exploited in today's world.

I wouldn't be surprised if an attacker easily grabbed your credentials, impersonated you or your friend, and uploaded a virus to the Pi. I'm not qualified enough to say what kind of attack would allow this, but I believe a MitM (man in the middle) would be extremely easy with a standard that doesn't use basic encryption.

I wouldn't risk plugging the card into a card reader to reformat it, you should destroy it and flash a new one. MicroSD's are pretty cheap these days. Also, if you or your friend use the same password on other stuff as the one you used for FTP (and if you're uninformed enough to use FTP, you guys might have made this mistake too) you should change them ASAP, they're compromised.

Instead of FTP, what you SHOULD be using is SFTP. It's based on SSH, which is another standard that allows you to remotely access the command line of another machine. Unlike FTP, SHH (and by inheritance SFTP) actually encrypts your credentials before sending them over. And if you're really serious about security, you can set it up to only allow access via SHA-256 key verification (those public and private keys you keep hearing about everywhere).

"But all my scripts will break!" First of all, if whatever you're using only supports regular FTP it's a 99% chance it's horrendously outdated. But if you insist, SFTP is designed to be backwards compatible with FTP programs. Sometimes, all you have to do is change all the ftp in a script to sftp and boom, you're secured.

For a rundown on securing your Pi, go here: https://www.raspberrypi.org/documentation/configuration/security.md

| improve this answer | |
  • Thanks for the comments, but I don't think someone could have captured our passwords. Why? Because the system wasn't operational yet. That is, the little Pi was up and running, but I was still writing the software for my friend to access the system with. He's very UNsavy, so I was making a Python GUI program. So the system was just sitting there. Listening but having very, very little traffic. And as I said, it had some audiobooks on it, no personal data or any other such. – LarryM Mar 18 '18 at 12:48
  • Even if some "external user" had gotten a login and password, having the system download the books shouldn't have been as disruptive to my system as this was. I really think the system was under some form of attack. Are there any logs that might show what was happening to it? – LarryM Mar 18 '18 at 12:58
  • But I will re-flash the card and institute SFTP, thanks for that tip, and I will also do the other tips in the link, but I think there's more to this... – LarryM Mar 18 '18 at 13:00
  • security.stackexchange.com/questions/121759/… – Fabian Mar 18 '18 at 21:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.