Printable View
Hi,
We are running a web server on RED HAT linux 8.0. But the root password keeps on getting changed. We reset the password to new one. But after about one or two days the system again says that password is not accepted.
We are running Apache, Mysql 3, a php based web site(which accesses mysql), Java SDk 1.4, A java program which accesses mysql(not accessible from internet.(Think so)).
Can you plz advice me on what to do. Can a remote attacker change the root password.
Thanks,
Chamal.
Yes, if your box is owned, the attacker can change the root password at will. If your password keeps changing, and you are positive that it is not being done by someone else in you organization, who has authority, then your box is OWNED. It cannot be trusted at all. You need to take it offline, and either investigate it to figure out if you can find out how the attacker got in(this is preferable since you may find some security issues in your code) but maybe you do not have the skills to perform the forensic investigation, or the time, or the money to hire someone who can, so, below is what you probably should do.
My advice for whatever it is worth:
1. Take box offline.
2. backup data.
3. wipe box.
4. reinstall, you might want to consider using fedora core 3 instead of RH8.
5. bring box back online, behind a firewall that is not allowing inbound connections to it.
6. install any required updates. if you still using redhat 8, I believe that there is a channel on the fedora core yum repository for security updates for rh8. info about updateing using yum on RH8 can be found here
http://www.fedora.us/wiki/FedoraHOWTO
7. decide what services you are going to be serving on this box, and then research them to acquire a basic knowledge about what issues there are with security. Specifically, look into php security, and apache, and any other services which are going to be open to connection from the outside world. Do you use phpBB? There are some issues with certain versions of that and you might need to upgrade or use a work arround. Have you investigated php security at all, are you sure your code is safe? I am not much of a php coder, but someone here can surely tell you the most common issues with security and php.
8. Secure your applications and code to the best of your ability.
8a. I would do this, but the config can be a bit daunting for a newb. Install tripwire, and then scan the machine to create a baseline which can be compared to later, and then if you have an issue again, you can KNOW what changes were made.
9. Allow access to the services you require through the firewall again.
It would also be nice if you setup an IDS which took a look at all traffic coming to and from that box. This may be daunting though if you do not have experience. You probably should take a brief look at snort, just to see if that may be something you want to delve into.
EDIT:
Some more things:
Make sure you use a strong password for root
Also, strong passwords for the mysql connections, and access control lists in mysql to determine exactly which users are allowed to connect to mysql from which boxes.
you probably want to restrict remote management by ssh to only ip's that you know need it, if that is not possible, maybe look into port knocking, check out this site.
http://www.soloport.com/iptables.html
Also, make sure that your firewall is configured well. You want to use egress(outgoing) filtering as well as ingress(incoming) filtering. Only ports that are required for your external users should be allowed in, i.e. http, and ssh with access controll lists, or port knocking. Only ports that are required for the services you are offiering should be allowed out through the firewall. If that is the case, if someone does manage to exploit your code, or the httpd service, life is made more dificult for them to do anything usefull with the box, like connect to it for management, or initiate attacks onto other boxes.
before doing all that I would recommend check /etc/shadow or /etc/passwd for any back door accounts. If they are there delete them. Check your /var/log/ logs and see if anyone has been sshing or telneting in and what usernames they were using. If they are any good you won't see anything but it is worth a try. Also set up snort or another IDS to see if any attempts are made. check netstat -all and see if any odd ports are open. try ps /aux to see if any odd processes are running. Try a vulnerability scan on your box, and make sure you have all the most recent updates from Red Hat.
Only problem with that is if his box is owned, it cannot be trusted. Ok, he finds a user account and deletes it. runs a vulerablility scan, fixes the vulnerabilities. Then runs ls to get a directory listing, or locate to find a file, or any other of a number of commands, and discovers after his box is compromised again, that he ran a custom version of ls, or locate, or whatever that installed a rootkit, added the some users, and somehow sent the original attacker a message that the box is now available again for his use.
Also, you cannot get updates from RedHate anymore for redhat 8. Unless you use the method I mentioned, which is to install yum, and use the redhat 8 security update channel on the fedora yum repository. Or you could pay money to a third party who is maintaining redhat 8.
If someone unidentified has root level access to the box, it cannot be trusted AT ALL, unless you have a good(saved on CD or other external write once media) tripwire database (or some other file system integrity check)and can use that to KNOW what changes have been made, and then fix those items which have been changed.
Yes my post was long, had lots of suggestions, but the bottom line is,
Backup data,
reinstall
patch
secure
restores data
make available to outside world again.
That really isn't "all that" much to do, especially if they are using this box for anything important. It needs to be fixed, and made secure, and most of all TRUSTED.
how upto date was that redhat 8 box ??
I'd say own fault.. but still take caution and make sure you only backup the website, non of that we'll clean out the box stuff..
I have an updating list of zombie linux boxes with a php worm or something..
They seem to have a weird port open with a shell as user nobody, and there are numbers of exploits for oder linux (kernel) versions and other common sotfware found on linux servers. there's numbers of possible ways to get root on servers with sloppy update routines ;)
Start with a fresh up to date linux distribution and keep your server up to date..
damn, I guess I didn't think too much before my first post. You guys are right. the wipe and Format and re-install thing is probably a better idea.
I would still try and figure out how/and where the compromise happened. If you TOUCH that box w/o making a legal forensic backup (depends state-to-state whats considered legal) than you just threw your case out of court. After you clone the system (Your state law-enforecement may have to come use their own ****) you can have the orignal bagged and tagged as they say, and work from the duplicate. Using known good binaries is standard practice, there are plenty of CD based security CD's like KNOPPIX or INSERT which will provide them. Even if you dont use the box again its always good to:
A. Have a case to prosecute if so desired.
B. Know what happened so it won't happen again.
I would CHECK YOUR LOGS. Its what they are there for.
-Maestr0
http://www.securityfocus.com/infocus/1811
http://www.rootkit.nl/
http://www.chkrootkit.org/
EDIT: On closer inspection, I notice Chamal isnt in the US, so I have no idea how this affects your legal standing, the rest still applies. :)
If this is for a company, then DO NOT use FC3. FC series is purley beta testing, and is purposly filled with experimental drivers/programs/functonality. This is because it is a testing playground for their company based product: RedHat Enterprise. I can't imagine what the built in SELinux patches would do to his php server permissions.Quote:
reinstall, you might want to consider using fedora core 3 instead of RH8.
Hi guys,
Thanks a lot for your replies. They were so useful.
I do not have much experience in handling log file. Can you advice me on the things that I should search inside log files.
Best regards,
Chamal.
<ramble>
Check for 'failed password' or 'bad login attempt' something of that sort. Look through the /var/secure logs. Also I would look for sshd or telnet connections. It will say something likeI would also check to see if there are any server processes running (daemon I believe is the correct term) that you didn't set to run. If you never set up ssh and there is a ssh daemon running, get worried. Same with telnet. (although the telnet daemon is part of the xinetd process if I remember correctly)Quote:
Jan 15 12:34:56 | localhost | |program name| start : | program Id # | | from (now this is the line to pay attention to) | somewhere(IP address of who connected to the server process)
type 'chkconfig --list' (you might want to try 'chkconfig --list | more') and look under the xinetd based services, see if telnet is running under that. sshd should be it's own seperate process.
... or they could've put in an backdoor ...
for that, you probably want to check what is listening on what port. type netstat -all | more see anything odd ? (This is all mentioned in my first post so I don't know why I am going over it again :D ) just remember that if your box is owned, don't trust it.
</ramble>
Well, at first I was going to disagree with chill's assessment of Fedora...but it got me thinking, and I did a little reading, and now I'm not so sure if I was wrong.Quote:
Originally posted here by a morning chill
If this is for a company, then DO NOT use FC3. FC series is purley beta testing, and is purposly filled with experimental drivers/programs/functonality. This is because it is a testing playground for their company based product: RedHat Enterprise. I can't imagine what the built in SELinux patches would do to his php server permissions.
I wanted to retort with 'Fedora is the open distro sponsored by Red Hat, but not supported or developed actively. It's a stable desktop or server OS if you use the stable versions, etc.' Turns out I may not be right...they say it's a community based initiative, and includes technologies that may make there way into Red Hat products eventually...but I didn't heard enough language or see enough commitment to making it secure, stable, and dependable. Time for Suse, I guess.
Also, I can say that SELinux does indeed break some web application deployments with it's default settings. I tried to follow a HOWTO I found recently on "Snort, Apache, SSL, PHP, MySQL, and Fedora Core". I followed it to the 'T' with Fedora Core 3 with the exception of enabling SELinux, but this doco (older version...a new one now exists) was written for Fedora Core 2. SELinux made communiations between MySQL and PHP/Apache impossible without modifying their labels/groups/schemas etc. Good seed to get me working on learning SELinux, but time is a precious commodity, and it hasn't happened.
So I'd say be very careful on choosing a new linux platform. I tend to recommend Fedora a lot for newbies trying to learn Linux (mostly because, while I'd like to start them on Slackware, I don't want to get the phone calls on "how do I do this?"...you get less of them with Fedora). But for a production server, keep looking and do your homework.
i friends,
I think I found some clues to think that my system is hacked. But I do not know for sure.
I have copied some suspicous sections from my messages log file, apache access and error log files. Can you please check them and give me some hints. I know inspecting this content will be time consuming. So just check them if and when you guys have free time.
messages.log
===============
Feb 11 01:22:40 mail sshd[5384]: Could not reverse map address 80.96.93.222.
Feb 11 01:22:40 mail sshd(pam_unix)[5384]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=80.96.93.222 user=test
Feb 11 01:22:50 mail sshd[5384]: Failed password for test from 80.96.93.222 port 1178
Feb 11 01:22:58 mail sshd[5384]: Failed password for test from 80.96.93.222 port 1178
Feb 11 01:23:03 mail sshd[5384]: Accepted password for test from 80.96.93.222 port 1178
Feb 11 01:23:06 mail sshd(pam_unix)[5391]: session opened for user test by (uid=594)
Feb 14 10:58:33 mail modprobe: modprobe: Can't locate module char-major-10-134
Feb 15 11:05:35 mail syslogd: Printing partial message
Feb 15 11:05:35 mail 22>Feb 15 11:05:35 sendmail[2798]: j1F55ZTb002798: mail.w-advertise.com [81.255.114.13] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Feb 15 11:05:35 mail
Feb 17 10:42:53 mail 22>Feb 17 10:42:53 sendmail[7447]: j1H4grTb007447: mail.w-advertise.com [81.255.114.13] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Feb 17 10:42:53 mail
Feb 17 10:56:48 mail
Feb 17 10:56:48 mail syslogd: Printing partial message
Feb 17 10:56:48 mail
//Plz note this. I could not login as root. My password wasn't accepted.
//But how can the root users session get closed.
//***********************************************
Feb 17 11:03:01 mail sshd(pam_unix)[2905]: session closed for user root
//****************************************************
Feb 18 02:52:15 mail syslogd: Printing partial message
Feb 18 02:52:15 mail 22>Feb 18 02:52:15 sendmail[15542]: j1HKqFTb015542: mail.w-advertise.com [81.255.114.49] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Apache access.log
====================
220.3.124.75 - - [10/Feb/2005:17:58:32 +0600] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 1060 "-" "-"
66.249.64.79 - - [10/Feb/2005:16:14:34 +0600] "GET /englishReports.php HTTP/1.0" 304 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
66.249.71.61 - - [10/Feb/2005:17:41:01 +0600] "GET /allReports.php HTTP/1.0" 304 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
193.109.122.59 - - [14/Feb/2005:09:34:44 +0600] "CONNECT 193.109.122.67:6668 HTTP/1.0" 405 982 "-" "pxyscand/2.0"
203.94.95.111 - - [19/Feb/2005:18:17:33 +0600] "PROPFIND /reports/ HTTP/1.1" 405 990 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
207.46.98.141 - - [20/Feb/2005:04:27:02 +0600] "GET /robots.txt HTTP/1.0" 404 1059 "-" "msnbot/1.0 (+http://search.msn.com/msnbot.htm)"
207.46.98.141 - - [20/Feb/2005:04:27:02 +0600] "GET /circulars.htm HTTP/1.0" 404 1059 "-" "msnbot/1.0 (+http://search.msn.com/msnbot.htm)"
193.109.122.44 - - [20/Feb/2005:07:41:39 +0600] "CONNECT 193.109.122.67:6668 HTTP/1.0" 405 982 "-" "pxyscand/2.0"
220.247.246.9 - - [20/Feb/2005:08:44:56 +0600] "GET /smHeadOffice.jpg HTTP/1.1" 304 0 "http://cc.msnscache.com/cache.aspx?q=1039146196537&lang=en-US&FORM=CVRE" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
220.247.246.9 - - [20/Feb/2005:08:44:56 +0600] "GET /smBranches.jpg HTTP/1.1" 304 0 "http://cc.msnscache.com/cache.aspx?q=1039146196537&lang=en-US&FORM=CVRE" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
220.247.246.9 - - [20/Feb/2005:08:47:10 +0600] "PROPFIND /reports HTTP/1.1" 301 325 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
220.247.246.9 - - [20/Feb/2005:08:47:10 +0600] "PROPFIND /reports/ HTTP/1.1" 405 990 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
220.247.246.9 - - [20/Feb/2005:08:47:11 +0600] "PROPFIND /reports HTTP/1.1" 301 325 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
Apache error.log
================
[Fri Feb 11 10:25:45 2005] [error] [client 66.249.64.47] File does not exist: /var/www/html/robots.txt
[Fri Feb 11 11:16:17 2005] [warn] child process 1264 still did not exit, sending a SIGTERM
[Fri Feb 11 11:16:17 2005] [notice] caught SIGTERM, shutting down
[Fri Feb 11 11:16:20 2005] [notice] Digest: generating secret for digest authentication ...
[Fri Feb 11 11:16:20 2005] [notice] Digest: done
[Fri Feb 11 11:16:21 2005] [notice] Apache/2.0.40 (Red Hat Linux) configured -- resuming normal operations
[Fri Feb 11 11:16:27 2005] [notice] caught SIGTERM, shutting down
[Fri Feb 11 11:16:29 2005] [notice] Digest: generating secret for digest authentication ...
[Fri Feb 11 11:16:29 2005] [notice] Digest: done
[Fri Feb 11 11:16:30 2005] [notice] Apache/2.0.40 (Red Hat Linux) configured -- resuming normal operations
[Fri Feb 11 12:44:20 2005] [error] [client 66.249.66.38] File does not exist: /var/www/html/robots.txt
[Fri Feb 11 12:53:51 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_inf.html
[Fri Feb 11 12:53:51 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_bin
[Fri Feb 11 12:53:51 2005] [error] [client 192.168.0.99] no acceptable variant: /var/www/error/HTTP_NOT_FOUND.html.var
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_inf.html
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_bin
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] no acceptable variant: /var/www/error/HTTP_NOT_FOUND.html.var
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_inf.html
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_bin
[Fri Feb 11 13:19:10 2005] [error] [client 192.168.0.99] no acceptable variant: /var/www/error/HTTP_NOT_FOUND.html.var
[Fri Feb 11 13:19:24 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_inf.html
[Fri Feb 11 13:19:24 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_bin
[Fri Feb 11 13:19:24 2005] [error] [client 192.168.0.99] no acceptable variant: /var/www/error/HTTP_NOT_FOUND.html.var
[Fri Feb 11 13:23:00 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_inf.html
[Fri Feb 11 13:23:00 2005] [error] [client 192.168.0.99] File does not exist: /var/www/html/_vti_bin
[Fri Feb 11 13:23:00 2005] [error] [client 192.168.0.99] no acceptable variant: /var/www/error/HTTP_NOT_FOUND.html.var
[Fri Feb 11 19:16:46 2005] [error] [client 195.92.95.61] File does not exist: /var/www/html/cobalt-images
[Fri Feb 11 20:08:58 2005] [error] [client 66.249.66.38] File does not exist: /var/www/html/robots.txt
[Sun Feb 13 04:02:09 2005] [notice] SIGHUP received. Attempting to restart
[Sun Feb 13 22:39:42 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/Forum
[Sun Feb 13 22:39:43 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/Forums
[Sun Feb 13 22:39:45 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/bb
[Sun Feb 13 22:39:47 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/ugboard
[Sun Feb 13 22:39:49 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/ugboards
[Sun Feb 13 22:39:49 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/ugboards
[Sun Feb 13 22:39:55 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/newboard
[Sun Feb 13 22:39:57 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/newboards
[Sun Feb 13 22:39:59 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/members
[Sun Feb 13 22:40:00 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/members
[Sun Feb 13 22:40:02 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/members
[Sun Feb 13 22:40:03 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/portal
[Sun Feb 13 22:40:05 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/portal
[Sun Feb 13 22:40:07 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/bbs
[Sun Feb 13 22:40:08 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/bulletinboard
[Sun Feb 13 22:40:10 2005] [error] [client 202.175.237.42] File does not exist: /var/www/html/bulletinboards
[Mon Feb 14 00:42:57 2005] [error] [client 207.46.98.141] File does not exist: /var/www/html/robots.txt
[Mon Feb 21 14:28:25 2005] [error] [client 220.247.240.88] File does not exist: /var/www/html/_vti_bin
Best Regards,
Chamal.
Chamal,
OK, I am just replying off the cuff, with a bit of searching to refresh my memory. Without more context, I don't think that we can tell you for sure from what you provided, a lot more is needed, and this forum probably isn't the best place to post it. Besides, it might take a lot of time to really go through the system and analyze it, people who are good at that get paid for it. WE have some nice folks here apparently, but asking someone to do a forensic analysis of your box is a bit more than most of us can handle for free in a forum. I will just offer some quick items about what I see. I think the best evidence you have provided so far is the fact that your root password keeps getting changed.
The obvious thing is someone logging in via ssh as user test. and failing, then succeeding. Did you create a user named test? Does this user have an easy password which might be guessed, like test, or 12345? Without knowing a more of your network info, this might be legit, though it does seem to originate in Romania based on output from www.ripe.net/whois. Do you have a legit user in Romania? Once someone knowledgeable has a foothold by way of a user login via ssh, getting root is fairly simple especially if your system is not patched.
The "session closed for user root" message occurs when root logs out from a ssh session. So, whoever was connected, disconnected.
the modprobe error is just some kernel module that isn't working, looks like some issue with power management. probably unrelated to your current problem.
the items in maillog are probably nothing, looks like some standard error messages. One comment though, you might want to think about using a different MTA, sendmail has historically had "some issues" with security. Postfix is a decent alternative, I think it is included on the RH 8 cd's along with the command redhat-switch-mail, or redhat-switchmail which will make postfix your MTA, it basically just turns off sendmail, turns on postfix, and updates a bunch of symlinks so that your system knows how to send mail using postfix instead. qmail is a good alternative as well, but, that would require more work that using the builtin tools to swithc to postfix.
The apache access log items are, search engines searching your site for content, and someone connecting to(or trying to) a WebDAV enabled directory on your site. Do you run webDAV for anything?
Also, apache needs to be upgraded. There have been a number of vulnerabilities fixed since 2.0.40 was released, most of them are just denial of service, but some "MIGHT" enable running arbitrary code, which is a bad thing. See
www.apacheweek.com/features/security-20
The pxyscand/2.0 message might be someone looking for a vulerable proxy, based on a short(very short) google search about that message.
The default.ida message you can ignore, it is just someone or something looking for vulnerable IIS installs.
In the error log, It looks like your apache has a bit of an issue and is restarting. Also, do you run mod_frontpage? It looks like someone on your local lan(192.168.0.99) is trying to get to some files that might be associated with that. From the _vti_bin and _vti_inf.html messages. I must admit, after looking through some of my error logs, I have quite a few of these myself, probably unrelated to your hack. Most likely just some scanning for vulnerabilities, though, why do they come from your local lan, maybe someone has a virus? 192.168.0 is your local lan right as it couldnt be coming in off the internet?
To those that disagree with the recommendation of Fedora Core 3:
You may well be correct about not using it. I personally use RH Enterprise linux products when I need to run linux in a corporate environment. I merely mentioned it because, I infered that chamal and co, used RH8 just because they had it, since RH does not offer any updates for RH 8 via up2date anymore, I was really suggesting that chamal update to a newer distro, and Fedora Core seemed to be an "easy" upgrade path, especially for one who is used to the custom redhat tools.
Of course, as I mentioned, it is possible to get security updates for RH8 through the fedora yum repository.
Later,
ptr
EDIT:
See IKnowNot below, I think this is the best course, as I stated above. Besides, if you are truly in Sri Lanka, like your location states, and the apparent(from what logs you did provide) attacker appears to be in Romania, or at least using romania as a jumping off point, this is a legal nightmare. Just forget about the legal stuff, if you do forensic analysis, it should only be to figure out how they got in, but, I am guessing a easy password on the test account did it, unless they added that themselves after the fact.
If you want to do a forensic on the box, get a new drive(or drives if you use raid) throw that in the box, reinstall, and send the other disk out to someone who knows what they are doing.
I don't know why this thread has gone on so long ... ptr said it ... wipe it
I assume you don't care about legal aspects as [b] Maestr0 [/] was referring to.
since you only included parts of the log files, AND a good hacker would have removed his/her footprints from there anyway we can not get a true picture.
As far as RH 8 ... dump it too. Although it is in fedoralegacy, it is no longer being patched. If you are going to use RH, try RH 7.3 or RH 9.
Fedora ( use only Fedora 3 ) may be ok if you know what you are doing and what to remove but would probably stay away from it in a production enviroment. Free is nice, but if the company depends on the server it may be cheaper in the long run to pay to have the support and “ tuned” OS like RH server.
Just some things to start off when designing the new server:
protect it with a firewall ( why is someone using port 1178 to connect ? This should not be )
limit services on the server. ( Why is sshd running? do you need it ? Do you need it allowing connections from the Internet? )
As for user “ test” ... looks like they used a script to connect and search for actual users and passwords. ( note the times on the failures .. can anyone type that fast? ) Also looks like there may have been an “easy” password as only a few attempts were made before success.
what did the .bash_history file reveal? was it empty or really outdated? ( could be redirected )
also try something like
“ grep :x:0: /etc/passwd “
old trick but can sometimes show unknown accounts ( there should be only ONE entry )
From the little I know about logs, I have gathered this:
Oddly enough, this seems to be a port for skk, A japanese translator or something. Didn't look into it too much but it is for encoding japanese characters. Although this seems to suggest that someone did indeed succeed in gaining access, using the account test.Quote:
Feb 11 01:22:50 mail sshd[5384]: Failed password for test from 80.96.93.222 port 1178
Feb 11 01:22:58 mail sshd[5384]: Failed password for test from 80.96.93.222 port 1178
Feb 11 01:23:03 mail sshd[5384]: Accepted password for test from 80.96.93.222 port 1178
Feb 11 01:23:06 mail sshd(pam_unix)[5391]: session opened for user test by (uid=594)
kinda looks like some spam is floating around in there. The mail.w-advertise.com is in french (well http://www.w-advertise.com is) The spammers love an unpatched box with sendmail still runningQuote:
Feb 15 11:05:35 mail syslogd: Printing partial message
Feb 15 11:05:35 mail 22>Feb 15 11:05:35 sendmail[2798]: j1F55ZTb002798: mail.w-advertise.com [81.255.114.13] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Feb 15 11:05:35 mail
Feb 17 10:42:53 mail 22>Feb 17 10:42:53 sendmail[7447]: j1H4grTb007447: mail.w-advertise.com [81.255.114.13] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
I am going out on a limb here, but I think that your box may have been comprimised for sending spam. I could be wrong (and hope I am). Maybe I am just looking for something that is not there.
These are just my thoughts based on what little knowledge I have. Hope I am heading in the right direction.
/Edit : IKnowNot is right Wipe that sucker. Couldn't advise on a distro, though
Hi guys,
I want to thanks all of you for helping me. Your help was quite useful.
I ll try to follow your advice.
I also want to thanks this site. It is so useful.
Best regards and see you soon,
Chamal.