Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

i found some strange informations in /var/log/secure file:

Feb 10 02:02:04 server2364 usermod[30750]: unlock user `username1' password
Feb 10 02:02:04 server2364 usermod[30811]: lock user `username2' password
Feb 10 02:05:16 server2364 usermod[30992]: unlock user `username2' password
Feb 10 02:05:18 server2364 usermod[31114]: unlock user `username1' password

username1 and username2 are two usernames on system, that have no ability to login.

for every night in 02:02h results like that are in /var/log/secure file.

one more thing: files /etc/shadow, and /etc/shadow have timestamps 02:05h.

what can be cause for it?

next thing, if i remove those two accounts (username1 and username2), i can not start web server.

can you help me with some ideas, am i hacked?

UPDATE: like Daniel Lawson suggested below, i run netstat -ln -pv | grep 465, and result is:

netstat: no support for `AF INET (sctp)' on this system.
tcp        0      0 0.0.0.0:465                 0.0.0.0:*                   LISTEN      3000/master         
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
share|improve this question

1 Answer

up vote 0 down vote

The usermod lock/unlock commands will update /etc/passwd and /etc/shadow at the time they are run, as these tools update the authentication backend. So, this is expected behaviour, given that something is running a script to lock/unlock those user accounts

Given that these lock/unlock events happen at 2am every day, you should look for a crontab entry that is running them. Try the following command and update your post with the output

sudo grep usermod /etc/cron* /var/spool/cron/ -R

Regarding the apache problem, without knowing either what the usernames are, or more information about your apache configuration, it's pretty hard to suggest what is happening.

Is this machine a VM provided by a hosting company?

share|improve this answer
i tested my server with chkrootkit, and it tells me: Checking `bindshell'... INFECTED (PORTS: 465). is server rooted? or is it false positive? i do have plesk on that server. – user52869 Feb 10 '11 at 9:21
also, i can not find any usermod commands in dirs you mention – user52869 Feb 10 '11 at 9:39
That sounds like it probably is infected then. Backup your data and reinstall the machine. – Daniel Lawson Feb 10 '11 at 20:35
is not possible to clean machine? also, i found that can be false alarm, because plesk is installed on machine... rkhunter did not notice anything strange – user52869 Feb 10 '11 at 21:18
Cleaning an infected machine is very tricky to do, unless you know exactly what you're doing. Quite simply, if the machine is actually compromised, you have no idea what's been changed, and if it's been done well, you can't easily tell what's been changed. However, you may be right about the false alarm. Update your post with the output of "netstat -ln -pv | grep 465". Can you also elaborate on which users are being changed? – Daniel Lawson Feb 10 '11 at 21:28
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.