Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running debian server and i have received a strange email warning about ssh login It says, that user mail logged in using ssh from remote address:

Environment info:
USER=mail
SSH_CLIENT=92.46.127.173 40814 22
MAIL=/var/mail/mail
HOME=/var/mail
SSH_TTY=/dev/pts/7
LOGNAME=mail
TERM=xterm
PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
LANG=en_US.UTF-8
SHELL=/bin/sh
KRB5CCNAME=FILE:/tmp/krb5cc_8
PWD=/var/mail
SSH_CONNECTION=92.46.127.173 40814 my-ip-here 22

I looked in /etc/shadow and find out, that password for is not set

mail:*:15316:0:99999:7:::

I found this lines for login in auth.log

n  3 02:57:09 gw sshd[2090]: pam_winbind(sshd:auth): getting password (0x00000388)
Jun  3 02:57:09 gw sshd[2090]: pam_winbind(sshd:auth): pam_get_item returned a password
Jun  3 02:57:09 gw sshd[2091]: pam_winbind(sshd:auth): user 'mail' granted access
Jun  3 02:57:09 gw sshd[2091]: Accepted password for mail from 92.46.127.173 port 45194 ssh2
Jun  3 02:57:09 gw sshd[2091]: pam_unix(sshd:session): session opened for user mail by (uid=0)
Jun  3 02:57:10 gw CRON[2051]: pam_unix(cron:session): session closed for user root

and lots of auth failures for this user. There is no lines with COMMAND string for this user.

Nothing was found with "rkhunter" and with "ps aux" process inspection, also there is no suspicious connections was found with "netstat" (as I can see)

UPD forgot to mention: logins was relatively short - 26 seconds longest one according to "wtmp" log

Can anyone tell me how it is possible and what else should be done? Thanks in advance.

share|improve this question
    
possible duplicate of My server's been hacked EMERGENCY –  Tom O'Connor Jun 3 '12 at 9:51

3 Answers 3

First disconnect the system from the Internet.

It looks like the attacker was able to obtain root access to the system.

If the passwords used on this system were used elsewhere, change them.

Inform your users.

Reimage the system.

Change all passwords.

share|improve this answer
    
Thank you for your reply I can't disconnect it right now as far away from me and it is gateway also, as for now, there is no parasite traffic or connections from it I have already changed all user passwords and checked for if "new" users appeared –  Hikaru Jun 3 '12 at 12:06
    
</br> thanls, I wonder if "rpm -qV" will work for those systems which are using rpm Can you give me some advices, what can be done to find out what was done to the system I will replace compromised system with new one, but it will take some time –  Hikaru Jun 3 '12 at 13:12
    
@Hiharu, if that machine is a gateway there is a very strong possibility of your entire network being compromised. –  John Gardeniers Jun 6 '12 at 3:12

I'd start by putting "92.46.127.173" - Which I presume is their IP address, into /etc/hosts.deny as ALL: 92.46.127.173 - This will stop them getting back in.

then do ps aux|grep ssh and figure out which ssh process is theirs, and as root, killitdeadwithfire (kill -9 {that process PID}) - This will terminate their current shell connection, if they're logged in

Are you also running Samba on this server? That stuff about pam_winbind looks suspiciously like an exploit.

Might be worth installing denyhosts or Fail2Ban too, to catch more bruteforce attempts.

share|improve this answer
    
Completely forgot about hosts.deny, but I restricted all connections to ssh by ip, hope it will be enough. There was not any ssh connections, except mine. Yup, there is samba server (only winbind daemon running, for ntlm auth in squid) - should it be moved to inner host for better security? –  Hikaru Jun 3 '12 at 12:13
up vote 1 down vote accepted

So, how it was done and why it was possible: It was usual brute force attack (and i didn't protect system from it), but there was several preconditions:

1) system joined to ad

2) winbind configured and running on the system

3) There is such username on linux pc and in AD, and there is normal shell in /etc/passwd (interesting, why Debian system users has got /bin/sh by default)

4) /etc/pam.d/ssh configured to use winbind password and ssh server configured to use PAM (they both configured in a such way by default)

As result any domain user can log in with his credentials if there is user with the same name on linux.

share|improve this answer
    
Excellent! So the intruder did not acquire root access then. This illustrates the issues with configuring a linux server for authentication with AD. –  Dmitri Chubarov Jun 5 '12 at 11:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.