Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from 4.0. I'm afraid that something in the folders I've mentioned was modified. I can't reinstall the box, so is there any way to check the integrity of the system? I have already checked rkhunter and chrootkit.

share|improve this question
1  
Can you simply restore your backup to a temp location on some other system, and build md5/sha1 sums of them, then compare those against the server? You do have a backup right? –  Zoredache Mar 19 '10 at 7:37

4 Answers 4

up vote 7 down vote accepted

debsums, but it will only check files installed by packages, it can't tell you about extra files.

share|improve this answer
    
Thanks that was I was looking for! –  artvolk Mar 19 '10 at 7:23
9  
If you suspect your system has been compromised you can't completely trust that. At the minimum you should boot from a livecd use a copy of debsums that isn't from the potentially compromised environment. –  Zoredache Mar 19 '10 at 7:39
8  
The only real solution to a compromised system is from-scratch reinstall. –  ptman Mar 19 '10 at 9:16

When a system is compromised you're never sure if everything was cleaned and the best solution is always to reinstall the system, but you need to do some forensics to prevent that from happening again.

chkrootkit and rkhunter are good rootkit checkers but they're not infalible.

Also, run nmap from an outside machine and see if there's some port opened that you're not expecting.

debsums is also a good help when checking for compromised binaries.

And do you have any ideas how the hacker got access to the machine and which service was vulnerable? Focus especially there (but not only there). See if there are known issues with that software version. Check for every possible log you have in your filesystem. If you have a mrtg trending application (like ganglia, munin or cacti) check it for possible time frames of the attack.

You should also review your machine considering the following topics:

  • shut the services you don't need

  • test backup on a regular basis

  • follow the least privilege principle

  • have your services updated, especially regarding security updates

  • don't use default credentials

share|improve this answer

What about using AIDE?

https://help.ubuntu.com/community/FileIntegrityAIDE

share|improve this answer
    
AIDE is only a solution if you have a checksum of the known good files. After a suspected compromise it's not going help you sort out the good from the bad. –  3dinfluence May 13 '10 at 2:15

under debian there is the awesome tool : chkrootkit

aptitude install chkrootkit :)
share|improve this answer
2  
chkrootkit is garbage. Had a client with 2 rootkits and it did not detect either one. apt-get install rkhunter –  solefald May 12 '10 at 22:38
    
Nowadays, I also reckon that rkhunter is better than chkrootkit, but neither of them is infalible. –  Marco Ramos May 14 '10 at 12:59
    
thanks for the reference :) –  Razique May 17 '10 at 7:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.