2

I'm buying a Server from a person (that I don't know really well) and I want to make sure that the previous owner hasn't got any access anymore.

It's an Ubuntu Virtual Server and I already received the admin access (via shell).

How can I find out if there are still other accounts left, who are still able to access my server (e.g. with a still existing shell account, ftp or another type of user account)? And how can I delete them if these accounts exist?

Best regards, Jennifer

0

4 Answers 4

18

If previous admin really wants to keep accessing your server, there are too many ways to do that. If you don't trust them, you should reinstall your server with a fresh operating system.

1
  • 5
    +1, if you have to ask this question, you're in no position to try and ensure the machine is locked down. You either need to trust them, get a professional digital forensics person in to look at it, or reinstall.
    – Dentrasi
    Jun 11, 2010 at 14:19
3

On a Virtual Server, there is usually some sort of facility to reset the box (= install a brand-new OS image). If at all possible, go with that.

2

There is a very good probability that you have a brand new, freshly installed VPS. I can't think of anyone in the industry that would not give each new customer a freshly installed system.

If you are really concerned about the person that you are dealing with, you probably should not be dealing with them. I recommend going to any reputable Xen hosting provider, you can find reviews of them on sites like Web Hosting Talk.

I would also recommend hiring a qualified administrator (or, perhaps the provider offers managed services) to properly secure and configure your server.

Really .. if you are that worried, its probably for good reason. I'd just get one from a reputable host (e.g. member of the BBB, if applicable).

1
  • 2
    I think he's taking over someone else's image (like from a friend or acquaintance); not buying a new one from the hosting company...
    – Chris S
    Jun 11, 2010 at 12:14
1

As unbeli says, you can't be sure without doing a complete wipe. There are so many ways to backdoor a machine, there's no way you're going to be able to be completely confident.

However, there are some basic things you can check:

Check there are no accounts in /etc/passwd that shouldn't be there.

Revoke any SSH keys (~/.ssh/authorized_keys), both for the user and root accounts.

Check the startup scripts for anything malicious looking

Check the server isn't listening on any ports it shouldn't. Either use netstat -an | grep LISTEN, or scan it with nmap.

If there's a webserver, check for backdoored scripts. Searching for anything with "system" or "exec" in it is a start.

Check the crontabs for anything scheduled.

If it runs a mySQL server, check for accounts on that.

If you're feeling really paranoid, you can run rootkit checkers and the like, but if the guy knew what he was doing, you're not in a position to ever be sure without a reinstall.

You must log in to answer this question.