2

I believe my server has just got compromised interactively.

As this server will go to thrash anyway, I wonder if I can get a better insight of what the villain is doing by forcing logging of all tty.

Years ago I've seen a kernel patch, that does just that, but I can't find it anymore. I wonder, if such patch exist (I don't know how to write one).

The best would be, if the output wouldn't be stored locally, but forwarded to my other host (e.g. by http post or even as netcat).

My host uses 3.8 mainline kernel.

3

I don't have a kernel-level intercept patch, but this quick and dirty shell capture script can be placed in /etc/profile.d:

if [ -z $INSCRIPT ]; then
    export INSCRIPT=1
    DATE=`date "+%Y%m%d%H%M%S"`
    TTY=`tty | tr "/" "_"`
    script -qf "/tmp/${DATE}${TTY}.log" && exit
fi

This will create files in /tmp in format TIMESTAMP_TTY.log and will record almost all input / output (including special characters). The script itself does not announce thanks to the quiet flag, but is easily spotted in the process table if an attacker thinks to look.

Since you still have access to the system you could always retrieve these logs remotely, instead of pushing them out (configuring the system to push these files to a remote location opens up another target for the attacker).

  • Cool trick, but as you said, it is easily spotted. Will the script intercept all shell commands, like those issued on behalf of the user by e.g. Midnight Commander or Emacs? – Adam Ryczkowski Nov 11 '13 at 14:37
  • The script will only intercept input and output to the terminal proper (as per your question). If it appears on the terminal, it will be recorded (e.g., the output of ls, or vim). To audit all commands, including those from subprocesses you'll probably need something like psacct or SELinux. However, if you think the system is compromised - they'll likely be monitoring / disabling these services too. – plasmid87 Nov 11 '13 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.