"Security warning" dans la console - c'est grave docteur

Alors que j’ai voulu aller faire un tour sur mon serveur qui tourne depuis une bonne semaine sans trop de soucis je me suis retrouve avec une fenetre de console ouverte (IceWM etait lancé) contenant moultes messages dont voici le copier-coller:



Security Warning: Change in World Writable Files found :
                -       Newly added writable file : /tmp/.ICE-unix/dcop8087-1127
166870
                - No longer present writable file : /tmp/.ICE-unix/dcop23566-112
6902209

Security Warning: There are modifications for port listening on your machine :
                -  Opened ports : tcp        0      0 localhost:32768         *:
*                     LISTEN      2522/xinetd
                -  Opened ports : tcp        0      0 192.168.78.200:36901    *:
*                     LISTEN      5642/pure-ftpd (DOW
                -  Opened ports : tcp        0      0 *:netbios-ssn           *:
*                     LISTEN      2719/smbd
                -  Opened ports : tcp        0      0 *:sunrpc                *:
*                     LISTEN      2139/portmap
                -  Opened ports : tcp        0      0 *:10000                 *:
*                     LISTEN      2693/perl
                -  Opened ports : tcp        0      0 *:ftp                   *:
*                     LISTEN      2635/pure-ftpd (SER
                -  Opened ports : tcp        0      0 *:microsoft-ds          *:
*                     LISTEN      2719/smbd
                -  Opened ports : udp        0      0 localhost:32774         *:
*                                 3589/smbd
                -  Opened ports : udp        0      0 192.168.78.2:netbios-ns *:
*                                 2730/nmbd
                -  Opened ports : udp        0      0 *:netbios-ns            *:
*                                 2730/nmbd
                -  Opened ports : udp        0      0 192.168.78.:netbios-dgm *:
*                                 2730/nmbd
                -  Opened ports : udp        0      0 *:netbios-dgm           *:
*                                 2730/nmbd
                -  Opened ports : udp        0      0 *:10000                 *:
*                                 2693/perl
                -  Opened ports : udp        0      0 *:sunrpc                *:
*                                 2139/portmap
                - Closed ports  : tcp        0      0 *:netbios-ssn           *:
*                     LISTEN      12184/smbd
                - Closed ports  : tcp        0      0 localhost:32971         *:
*                     LISTEN      5355/xinetd
                - Closed ports  : tcp        0      0 *:sunrpc                *:
*                     LISTEN      2130/portmap
                - Closed ports  : tcp        0      0 *:10000                 *:
*                     LISTEN      2659/perl
                - Closed ports  : tcp        0      0 *:ftp                   *:
*                     LISTEN      2752/pure-ftpd (SER
                - Closed ports  : tcp        0      0 *:microsoft-ds          *:
*                     LISTEN      12184/smbd
                - Closed ports  : udp        0      0 192.168.78.2:netbios-ns *:
*                                 20874/nmbd
                - Closed ports  : udp        0      0 *:netbios-ns            *:
*                                 20874/nmbd
                - Closed ports  : udp        0      0 192.168.78.:netbios-dgm *:
*                                 20874/nmbd
                - Closed ports  : udp        0      0 *:netbios-dgm           *:
*                                 20874/nmbd
                - Closed ports  : udp        0      0 *:10000                 *:
*                                 2659/perl
                - Closed ports  : udp        0      0 *:sunrpc                *:
*                                 2130/portmap
                - Closed ports  : udp        0      0 localhost:48383         *:
*                                 20887/smbd

Security Warning: World Writable files found :
                - /tmp/.ICE-unix
                - /tmp/.ICE-unix/dcop8087-1127166870
                - /tmp/.X11-unix
                - /tmp/.X11-unix/X0
                - /tmp/.font-unix
                - /tmp/.font-unix/fs-1
                - /var/apache-mm
                - /var/lib/texmf
                - /var/lib/texmf/ls-R
                - /var/spool/postfix/dev/log
                - /var/spool/samba

Security Warning: These files belonging to packages are modified on the system :
                - /usr/X11R6/bin/startx
                - /usr/X11R6/lib/X11/fonts/TTF/fonts.cache-1
                - /usr/X11R6/lib/X11/fonts/Type1/fonts.cache-1
                - /usr/X11R6/lib/X11/fonts/misc/fonts.alias
                - /usr/X11R6/lib/X11/icewm/menu
                - /usr/lib/mailman/Mailman/mm_cfg.pyc
                - /usr/share/doc/HTML/index.html
                - /usr/share/fonts/bitmap/tscii/fonts.cache-1
                - /usr/share/fonts/default/Type1/adobestd35/fonts.cache-1
                - /usr/share/fonts/default/Type1/fonts.cache-1
                - /usr/share/fonts/ttf/armenian/fonts.cache-1
                - /usr/share/fonts/ttf/bengali/fonts.cache-1
                - /usr/share/fonts/ttf/decoratives/fonts.cache-1
                - /usr/share/fonts/ttf/ethiopic/fonts.cache-1
                - /usr/share/fonts/ttf/japanese/fonts.cache-1
                - /usr/share/fonts/ttf/kannada/fonts.cache-1
                - /usr/share/fonts/ttf/tamil/fonts.cache-1
                - /usr/share/fonts/ttf/thai/fonts.cache-1
                - /usr/share/fonts/ttf/tscii/fonts.cache-1
                - /usr/share/fonts/ttf/western/fonts.cache-1
                - /usr/share/fonts/type1/greek/fonts.cache-1
                - /usr/share/fonts/type1/hebrew/fonts.cache-1
                - /usr/share/texmf/ls-R

Security Warning: These config files belonging to packages are modified on the s
ystem :
                - /etc/X11/fs/config
                - /etc/X11/xdm/Xservers
                - /etc/bashrc
                - /etc/host.conf
                - /etc/hosts.deny
                - /etc/hotplug/blacklist
                - /etc/info-dir
                - /etc/inittab
                - /etc/login.defs
                - /etc/mailman
                - /etc/mdadm.conf
                - /etc/modprobe.conf
                - /etc/modprobe.preload
                - /etc/mtools.conf
                - /etc/pam.d/system-auth
                - /etc/pam.d/webmin
                - /etc/pam.d/xdm
                - /etc/postfix/main.cf
                - /etc/profile
                - /etc/pure-ftpd/pure-ftpd.conf
                - /etc/rc.d/init.d/webmin
                - /etc/rc.d/rc.local
                - /etc/samba/smb.conf
                - /etc/securetty
                - /etc/ssh/sshd_config
                - /etc/ssl/webmin/miniserv.pem
                - /etc/sysconfig/bootsplash
                - /etc/sysconfig/firstboot
                - /etc/sysconfig/msec
                - /etc/sysconfig/syslog
                - /etc/sysconfig/userdrake
                - /etc/sysctl.conf
                - /etc/syslog.conf
                - /etc/xml/catalog
                - /usr/share/config/kdeglobals
                - /usr/share/config/kdesktoprc
                - /usr/share/config/kdm/kdmrc
                - /usr/share/config/konquerorrc
                - /usr/share/sgml/docbook/xmlcatalog

Security Warning: There are modifications for port listening on your machine :
                -  Opened ports : tcp        0      0 192.168.78.200:21914    *:*                     LISTEN      13026/pure-ftpd (DO
                - Closed ports  : tcp        0      0 192.168.78.200:36901    *:*                     LISTEN      5642/pure-ftpd (DOW

Security Warning: These packages have changed on the system :
                -   Newly installed package : db1-1.85-10mdk    1127237312
                -   Newly installed package : libsnmp0-4.2.3-8mdk       1127237303
                -   Newly installed package : perl-Tk-800.024-4mdk      1127237315
                -   Newly installed package : ucd-snmp-utils-4.2.3-8mdk 1127237321

Security Warning: World Writable files found :
                - /tmp/.ICE-unix
                - /tmp/.ICE-unix/dcop8087-1127166870
                - /tmp/.X11-unix
                - /tmp/.X11-unix/X0
                - /tmp/.font-unix
                - /tmp/.font-unix/fs-1
                - /var/apache-mm
                - /var/lib/texmf
                - /var/lib/texmf/ls-R
                - /var/spool/postfix/dev/log
                - /var/spool/samba

Security Warning: These files belonging to packages are modified on the system :
                - /usr/X11R6/bin/startx
                - /usr/X11R6/lib/X11/fonts/TTF/fonts.cache-1
                - /usr/X11R6/lib/X11/fonts/Type1/fonts.cache-1
                - /usr/X11R6/lib/X11/fonts/misc/fonts.alias
                - /usr/X11R6/lib/X11/icewm/menu
                - /usr/lib/mailman/Mailman/mm_cfg.pyc
                - /usr/share/doc/HTML/index.html
                - /usr/share/fonts/bitmap/tscii/fonts.cache-1
                - /usr/share/fonts/default/Type1/adobestd35/fonts.cache-1
                - /usr/share/fonts/default/Type1/fonts.cache-1
                - /usr/share/fonts/ttf/armenian/fonts.cache-1
                - /usr/share/fonts/ttf/bengali/fonts.cache-1
                - /usr/share/fonts/ttf/decoratives/fonts.cache-1
                - /usr/share/fonts/ttf/ethiopic/fonts.cache-1
                - /usr/share/fonts/ttf/japanese/fonts.cache-1
                - /usr/share/fonts/ttf/kannada/fonts.cache-1
                - /usr/share/fonts/ttf/tamil/fonts.cache-1
                - /usr/share/fonts/ttf/thai/fonts.cache-1
                - /usr/share/fonts/ttf/tscii/fonts.cache-1
                - /usr/share/fonts/ttf/western/fonts.cache-1
                - /usr/share/fonts/type1/greek/fonts.cache-1
                - /usr/share/fonts/type1/hebrew/fonts.cache-1
                - /usr/share/texmf/ls-R

Security Warning: These config files belonging to packages are modified on the system :
                - /etc/X11/fs/config
                - /etc/X11/xdm/Xservers
                - /etc/bashrc
                - /etc/host.conf
                - /etc/hosts.deny
                - /etc/hotplug/blacklist
                - /etc/info-dir
                - /etc/inittab
                - /etc/login.defs
                - /etc/mailman
                - /etc/mdadm.conf
                - /etc/modprobe.conf
                - /etc/modprobe.preload
                - /etc/mtools.conf
                - /etc/pam.d/system-auth
                - /etc/pam.d/webmin
                - /etc/pam.d/xdm
                - /etc/postfix/main.cf
                - /etc/profile
                - /etc/pure-ftpd/pure-ftpd.conf
                - /etc/rc.d/init.d/webmin
                - /etc/rc.d/rc.local
                - /etc/samba/smb.conf
                - /etc/securetty
                - /etc/ssh/sshd_config
                - /etc/ssl/webmin/miniserv.pem
                - /etc/sysconfig/bootsplash
                - /etc/sysconfig/firstboot
                - /etc/sysconfig/msec
                - /etc/sysconfig/syslog
                - /etc/sysconfig/userdrake
                - /etc/sysctl.conf
                - /etc/syslog.conf
                - /etc/xml/catalog
                - /usr/share/config/kdeglobals
                - /usr/share/config/kdesktoprc
                - /usr/share/config/kdm/kdmrc
                - /usr/share/config/konquerorrc
                - /usr/share/sgml/docbook/xmlcatalog


c’est grave?

PS: c’est bizarre je suis persuadé d’avoir posté ma question hier ou avant-hier et je ne la trouve nulle part :heink:

Nan c’est juste que t’as plein de ports ouverts et vive le hack :paf:
Essaye avec shorewall de créer des règles pour bloquer ces ports … :ane:

pour les ports c’est pas un probleme: j’ai un bon petit routeur/firewall en amont qui bloque tout ça :wink: (linksys WRT54G). C’est pour ça que je ne me soucis pas trop des ports ouverts sur la machine :wink: (pas de firewall etc)

mais pour le reste: rien de mechant donc ?

Non, des packetages certainemment mis à jour … :neutre:

okay

Merci :jap:

De rien :miam: