2

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the attempted commands are known hacks, or known "tools" that can trigger these.

Pattern is pretty regular, usually about twice per hour alerted from a number of hosts--very unlikely a human, thus.

The alerts themselves are always one of these two:

myhost01 : Oct 29 17:50:41 : tzx : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/tzx ; USER=root ; COMMAND=lsof -nP +c0 -i4TCP

or

myhost02 : Oct 29 18:16:39 : tzx : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/tzx ; USER=root ; COMMAND=parted -l

where user "tzx" is a valid Linux user--typically used to run system services or cron jobs, but also permitted for SSH login (so as to prevent doing either function as root). I've used "last" on one or two of the affected hosts and I see shell sessions from user tzx, less than one minute each, roughly corresponding to the alerts we get. And, all those sessions appear to come from the same source host on the LAN (which I'm also digging at).

Has anybody seen this kind of traffic? Any known tools, hacks/probes or other "things" that tend to try this?

Half of me thinks I've got some user with some noisy (and nosey) tool of some kind and the other half thinks this is a more serious problem.

Improve this question
4
  • sessions appear to come from the same source host on the LAN - Does the source host happen to be some kind of monitoring system? Periodically Looking at open TCP sessions and the partition
    – Zoredache
    Oct 30, 2014 at 22:46
  • Good question, and not sure yet--am digging and also getting with the local admins to sleuth "who is that stinkin' host" as so far nobody knows. But I don't think it's a monitoring system unless somebody is trying to set one up on their own.
    – Dan
    Oct 30, 2014 at 22:49
  • BTW, I assume that this is happening over SSH, can you see how the user is authenticating? You might want to bump your SSH verbosity so the fingerprint of any keys being used is logged, once you do that, track it down to who or what owns that key. Do you have a good idea of who owns what keys that are authorized on this system?
    – Zoredache
    Oct 30, 2014 at 22:49
  • User is authenticating via password, not a key, according to /var/log/secure. Here's one that just happened a minute ago: Oct 30 17:49:19 myhost07 sshd[14617]: Accepted password for tzx from 192.168.10.29 port 36802 ssh2 Oct 30 17:49:19 myhost07 sshd[14617]: pam_unix(sshd:session): session opened for user tzx by (uid=0) Oct 30 17:49:26 myhost07 sudo: : user NOT in sudoers ; TTY=pts/3 ; PWD=/home/tzx ; USER=root ; COMMAND=lsof -nP +c0 -i4TCP
    – Dan
    Oct 30, 2014 at 22:58

1 Answer 1

Reset to default
2

SOLVED: one of the admins had installed Spiceworks on the LAN, with access to this user account, and Spiceworks was trying to run these alerted commands to accomplish its monitoring tasks. That's a big relief--apparently no malicious traffic on this one anyway. Here now for posterity.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .