Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm buying a Server from a person (that I don't know really well) and I want to make sure that the previous owner hasn't got any access anymore.

It's an Ubuntu Virtual Server and I already received the admin access (via shell).

How can I find out if there are still other accounts left, who are still able to access my server (e.g. with a still existing shell account, ftp or another type of user account)? And how can I delete them if these accounts exist?

Best regards, Jennifer

share|improve this question

migrated from stackoverflow.com Jun 11 '10 at 12:01

This question came from our site for professional and enthusiast programmers.

4 Answers 4

If previous admin really wants to keep accessing your server, there are too many ways to do that. If you don't trust them, you should reinstall your server with a fresh operating system.

share|improve this answer
5  
+1, if you have to ask this question, you're in no position to try and ensure the machine is locked down. You either need to trust them, get a professional digital forensics person in to look at it, or reinstall. –  Dentrasi Jun 11 '10 at 14:19

On a Virtual Server, there is usually some sort of facility to reset the box (= install a brand-new OS image). If at all possible, go with that.

share|improve this answer

There is a very good probability that you have a brand new, freshly installed VPS. I can't think of anyone in the industry that would not give each new customer a freshly installed system.

If you are really concerned about the person that you are dealing with, you probably should not be dealing with them. I recommend going to any reputable Xen hosting provider, you can find reviews of them on sites like Web Hosting Talk.

I would also recommend hiring a qualified administrator (or, perhaps the provider offers managed services) to properly secure and configure your server.

Really .. if you are that worried, its probably for good reason. I'd just get one from a reputable host (e.g. member of the BBB, if applicable).

share|improve this answer
2  
I think he's taking over someone else's image (like from a friend or acquaintance); not buying a new one from the hosting company... –  Chris S Jun 11 '10 at 12:14

As unbeli says, you can't be sure without doing a complete wipe. There are so many ways to backdoor a machine, there's no way you're going to be able to be completely confident.

However, there are some basic things you can check:

Check there are no accounts in /etc/passwd that shouldn't be there.

Revoke any SSH keys (~/.ssh/authorized_keys), both for the user and root accounts.

Check the startup scripts for anything malicious looking

Check the server isn't listening on any ports it shouldn't. Either use netstat -an | grep LISTEN, or scan it with nmap.

If there's a webserver, check for backdoored scripts. Searching for anything with "system" or "exec" in it is a start.

Check the crontabs for anything scheduled.

If it runs a mySQL server, check for accounts on that.

If you're feeling really paranoid, you can run rootkit checkers and the like, but if the guy knew what he was doing, you're not in a position to ever be sure without a reinstall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.