Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our general webhosting server (LAMP with Parallels Plesk) started to turn PROMISCUOUS mode ON on eth0 "by itself".

I noticed the change in configuration on 2013-11-08 when rkhunter warned us from "Possible promiscuous interfaces" which hadn't happened before. After a bit of googling I didn't find any real use case for promiscuous mode on our server, so I disabled it using # ifconfig eth0 -promisc only to find out a day later the flag has been re-set.

Here's what kernel logs says:

Nov  8 14:51:31 hallinta kernel: [3301285.098047] klogd1 uses obsolete (PF_INET,SOCK_PACKET)
Nov  8 14:51:31 hallinta kernel: [3301285.099528] device eth0 entered promiscuous mode
Nov 11 08:34:18 hallinta kernel: [3537242.374911] device eth0 left promiscuous mode
Nov 12 07:46:30 hallinta kernel: [3620559.485388] device eth0 entered promiscuous mode
Nov 13 08:47:36 hallinta kernel: [3710393.877512] device eth0 left promiscuous mode
Nov 14 07:53:49 hallinta kernel: [3793353.202243] device eth0 entered promiscuous mode
Nov 14 09:16:03 hallinta kernel: [3798274.154435] device eth0 left promiscuous mode

I included the klogd1 message because of its immediate timestamp. From auth logs I didn't see any suspicious activity around the first "entered promiscuous mode" message.

As the two enterings' timestamps are roughly similar I checked if I had any cronjobs running around that time. Most of the daily jobs (I searched with this tool) are run at 06:25 the latest and next job is run at 08:00. None of those 06:25 jobs contained the words ifconfig or promisc.

What could set promiscuous mode ON on eth0 interfaces and should I be worried? (I am, but should I be?) Is there any legit reason promiscuous mode should be set on?

share|improve this question
    
Does the host run any VMs? –  Michael Kjörling Nov 14 '13 at 9:44
    
@MichaelKjörling The host is a virtual server but does not host any. –  koiyu Nov 14 '13 at 10:34

2 Answers 2

Someone is probably running a packet sniffer, tcpdump, wireshark, etc. Look at last to see who was logging in. Double check the sudoers log if you have that configured.

share|improve this answer
    
Sniffing was the most probable resaon to enable promisc in such an environment, based on what I read too. How can I confirm someone/something is sniffing? I checked the auth log from November and all ssh logins were from our offices' IPs (except for two sftp connections which were from one of our clients' IP and using, of course, more restricted chrooted account). –  koiyu Nov 14 '13 at 8:34
1  
Are you running some traffic monitoring application e.g. ntop ? –  jijix Nov 14 '13 at 13:50
    
@jijix It seems we do have vnstat service running—although I see no difference in stats around times when I had turned promisc off (should I?). And, if the promiscuous mode was enabled all the time (I have no clue, I'm doing this more or less IATOD), I wonder why rkhunter started to warn about it not until last Friday. –  koiyu Nov 15 '13 at 7:20

If vnstat is the process putting the interface in promiscuous mode, check its logfiles and see if thit is logged (depends on logging verbosity of course). If there is no reason to monitor traffic, just disable it and see how it goes.

I suspect that promiscuous mode must be on while rkhunter is running, in order for rkhunter to detect it.

What is very very weird, is this:

Nov  8 14:51:31 hallinta kernel: [3301285.098047] klogd1 uses obsolete (PF_INET,SOCK_PACKET)
Nov  8 14:51:31 hallinta kernel: [3301285.099528] device eth0 entered promiscuous mode

AFAIK there is no such thing as klogd1 (there is a klogd of course), and there shouldn't be one. Take the time to check if there is a binary under that name and if there is a klogd1 process (if yes, find what it is doing). If vnstat is not doing that, then there is a high chance that your machine might have been compromised.

share|improve this answer
1  
Just from a quick Google search klogd1 doesn't look legitimate. There's at least 3 rootkit questions on the first page: google.com/search?q=klogd1 –  TheLQ Nov 19 '13 at 12:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.