Seltsame Dinge gehen vor?!?!?

[user0815]

Hallo zusammen,
habe es nun endlich mal geschafft mich hier anzumelden und habe dann auch gleich ein Problem.
Mein Server macht seltsame Dinge.
Zu Beispiel ist auf einem Server der Seit dem 5.11 läuft heute Nacht um 2 Uhr dem Cron aufgefalle das eine Datei (script) nicht existert. In der /var/log/messages ist der älteste Eintrag von 4 Uhr heut nacht. Das macht mich stutzig.
Bilde ich mir das ein, oder hört es sich nach einem Eindringling an?
Wie kann ich das am besten herausfinden?
Was kann ich tuen?

Vielen Dank

user0815

[psy]

hi,

überprüfe doch mal deinen server mit folgenden programmen.

http://freshmeat.net/projects/rkhunter/
http://freshmeat.net/projects/chkrootkit/

poste dann ggf. auffällige meldungen!

ciao
psy

[user0815]

Hallo,
Danke für die schnelle Antwort.
Habs gleich mal getestet.

beim rkhunter ist soweit FAST alles OK.


Einzige Auffälligkeit:
- PHP 4.3.4 [ Vulnerable ]

* Check: SSH
Searching for sshd_config...
Found /etc/ssh/sshd_config
Checking for allowed root login... Watch out Root login possible. Possible risk!
Hint: see logfile for more information
info:
Hint: See logfile for more information about this issue
Checking for allowed protocols... [ Warning (SSH v1 allowed) ]

---------------------------- Scan results ----------------------------

MD5
MD5 compared: 54
Incorrect MD5 checksums: 0

File scan
Scanned files: 328
Possible infected files: 0

Application scan
Vulnerable applications: 1

Scanning took 159 seconds

-----------------------------------------------------------------------


Das mit dem root login ist schon Geschichte.

Beim chrootkit bin ich über die follgenden Meldungen etwas gestolpert:


Searching for anomalies in shell history files... Warning: `//root/.mysql_history' file size is zero
nothing found
Checking `wted'... not tested: can't exec ./chkwtmp
Checking `z2'... not tested: can't exec ./chklastlog


Wär super wenn ich dazu noch eine Meinung bekäme.

[psy]

Beim chrootkit bin ich über die follgenden Meldungen etwas gestolpert:


Searching for anomalies in shell history files... Warning: `//root/.mysql_history' file size is zero
nothing found
Checking `wted'... not tested: can't exec ./chkwtmp
Checking `z2'... not tested: can't exec ./chklastlog


Wär super wenn ich dazu noch eine Meinung bekäme.
hast du ein "make" im ordner chkrootkit gemacht?

ciao
psy

[user0815]

Sch... wenn man blöd ist. Aber noch VIEL beschi...ner wenn es jemand bemerkt.

So nun hab ich auch ein make gemacht.
Finde aber in den Logs keine Fehler.

Wo könnte sonst noch mein Problem liegen???
Die Historie von MySql ist ebenfalls weg. (über nacht)!!!!!!!
SEHR SELTSAM.


ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not tested
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not infected
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.8.3/i586-linux-thread-multi/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/DBD/mysql/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Net/DNS/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Net/SNMP/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Net/Server/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Tie/IxHash/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/ycp/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Data/ShowTable/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/HTML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/HTML/Tagset/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Mail/SpamAssassin/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Mail/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/RRDp/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Unix/Syslog/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Bundle/NetSNMP/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Config/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Digest/HMAC/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Crypt/DES/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Archive/Tar/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Archive/Zip/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/w3mir/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Compress/Zlib/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/IO-stringy/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/mod_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Convert/TNEF/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/Convert/UUlib/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/libwww-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i586-linux-thread-multi/auto/MIME-tools/.packlist

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing foundSearching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth0: not promisc and no PF_PACKET sockets
Checking `w55808'... not infected
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... nothing deleted


DANKE!!!
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found

[psy]

also ich denke, du kannst davon ausgehen, dass nix schlimmes an deinem System ist, überprüfe aber lieber noch mal die logs (sshd, ftp?, web usw...) und schau ob bei dir alle updates installiert sind.

edit: starte mal den syslog-dienst neu und schau nach den fehlenden logs...

ciao
psy

[user0815]

Alles andere scheint OK.

DANKE!!!!!!!!!!!!!!!!!!!!!

[iceface]

* Check: SSH
Searching for sshd_config...
Found /etc/ssh/sshd_config
Checking for allowed root login... Watch out Root login possible. Possible risk!
Hint: see logfile for more information
info:
Hint: See logfile for more information about this issue
Checking for allowed protocols... [ Warning (SSH v1 allowed) ]
Also hier würde ich mir schon gedanken machen, ob das nötig ist.
Besser du setzt:
->Protocol 2
->PermitRootLogin no
in Deiner ssh-Konfiguration.

Weiterhin solltest Du bedenken, rkhunter und chkrootkit müssen nicht alles finden.

[gery]

ja! es muss ja nichts auf deinem server sein, vielleicht ein exploit oder das root passwd auf dem server auf sa.... :o
wegen den exlpoits eben updates, wie schon gesagt!