This question already has an answer here:
- How do I deal with a compromised server? 12 answers
Running (X)Ubuntu 10.04.2 LTS behind a router.
I just received an email from my root account on that machine, with the following subject:
*** SECURITY information for <hostname>:
The message body contained this warning:
<hostname> : jun 1 22:15:17 : <username> : 3 incorrect password attempts ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/sh /tmp/tmpPHBmTO
I can see no
/tmp/tmpPHBmTO file, though there is a file named
/tmp/tmpwoSrWW with a timestamp dating from 2011-06-01 22:14, so just before the mentioned date/time. It's a binary file, and the content doesn't look familiar to me. Also, that file only has
As I read it, this means that someone (or something) has (had) access to my machine. Apparently not root access (yet), but still, enough to write files to my
/tmp directory at the very least.
Does someone have any pointers as to where I could look for more information: who could have done this, and how they could have done this?
My router is configured to allow access to forward traffic for SSH, HTTP (nginx acting as reverse proxy for one of several other services), SMTP, POP (postfix) and IMAP (dovecot), and also port 51413 (Transmission).