Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I setup a linux server and forgot to disable clear text ssh password or install denyhosts or enable any kind of password policy. Usually I have deny hosts and it works well. As a result of missing this vital step (yes I should automate the process) a user with a weak password has been hacked. Now on the assumption that the general permissions are good what can I do to work out what they did and remove it?

By the way I am a programmer by nature not a system admin so please be kind!

share|improve this question

4 Answers 4

up vote 4 down vote accepted

You can never be completely sure what they did on the user account. But places to start are the .*history files in the home directory.

My advice would be to copy out the known good/important data and then blow the rest away. The intruder could have left any sorts of nasty surprises in configuration files, .bashrc, etc.

You should also check to see if any files owned by the user are on the system and look for running processes:

# find / -user USERNAME
# ps -a -u USERNAME

For the future, I would advise turning on process accounting. You can then check previously run commands using 'lastcomm'.

share|improve this answer

If you have a backup handy, you could compare that to the current filesystem to see what has changed. Pay particular attention to directories that would normally be in the path, such as /bin, /usr/bin, /usr/local/bin, /sbin, /usr/sbin, /usr/local/sbin, /opt/bin, etc.

Also look for a rootkit: http://serverfault.com/questions/6149/a-list-of-windows-rootkit-detection-and-removal-tools

But you can't know that you found everything that they did. Better to go back to a known good state (e.g., last backup) and bring the carefully checked data that has changed since then with you. Even better would be to wipe the system, and install an IDS before hooking it up to the network.

Unless you are running aide or tripwire or something similar, you don't have too many other options.

share|improve this answer

You should check the users history and roots history.
Look into /tmp for suspicious files (source code, executables, files owned by that user).
Use http://www.chkrootkit.org/ and/or http://rkhunter.sourceforge.net to check the system.
pstree/top/ps aux to check for running processes.
Look at the logfiles in /var/log for the specific time of the hack, if you have it.

share|improve this answer

Clear the user account by moving important data if any. Check for users command history to see if any script was run or any non-required command was run. Delete the user from the system and remove the home directory. Check if any cronjobs were set. Check all processes in detail to see if there was any background processes set by the compromised account.

Hope it helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.