1

One of the linux server was compromised and some of the connections are being originated from localhost to a remote location putting up the information residing on it. I'm trying to trace all outgoing connections from my server..

I have tried to

iptables -A OUTPUT -m tcp -p tcp --src 0/0  -j LOG  --log-prefix "LOCALHOST SOURCED IT" --log-level 7

, this doesn't show any progress on top of already applied rules or anywhere... can someone please guide what is wrong here.

1
  • do '-I OUTPUT' instead of '-A OUTPUT' Nov 19, 2014 at 12:58

1 Answer 1

1

In case of a compromise, there are usually two ideas:

  • take the machine off the net NOW, as it may inflict more damage. Check how the bad guy did come in and rebuild the machine from scratch without that specific loophole. Only restore from backups what exactly has been verified as "okay", don't be tempted to restore "the latest backup" and "remove some suspicious scripts". You don't know when the intruder entered your box, and with some bad luck, your restore from backup otherwise may also re-install the intruder's rootkit or other malware.

  • create forensically useful information and take the machine offline afterwards.

Forensic information is more along this:

  • https://github.com/504ensicsLabs/LiME to snapshot your RAM to disk (or network)
  • tcpdump -s 0 -w dumpfile.pcap to capture network traffic and later analyse this on a different/dedicated host, e.g. using wireshark or similar software.

Anyway: - Be aware that the attacker is not limited to tcp. they may also use udp or just any ip-based protocol. - If the intruder gained root access, they may have altered the logging mechanisms. You can't really trust the machine's logs anymore, the logs may have been filtered.

If you'd still like to perform some iptables logging:

iptables -I OUTPUT -p tcp -j LOG --log-prefix "LOCALHOST SOURCED IT" --log-level 7

should do the trick.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .