Re: bash_history file with vipw

> Date: Fri, 23 Sep 2005 16:28:28 +0200
> From: Wim Deprez <[email protected]>

> 
> I have just installed the new WU-FTPD on one of our Solaris servers.
> It is in a chroot'ed environment and accessible for only one
> guest-user. That guest-user uses /bin/false as "shell".
> 
> I was very confused when I found a .bash_history file in its
> homedirectory, which contains the following:
> 
> 	vipw
> 	exit
> 	telnet 127.1
> 	vipw
> 	exit
> 	pwd
> 	exit

Wim:

If I were you, I'd investigate to see if you have a rootkit installed.


If so, you might want to make sure that you HAd the latest security
patches installed, and if not, reimage the system and backing up any
data first.

Here are some pointers for root kit checkers:

Install & configure chkrootkit	http://www.chkrootkit.org/
--------------
Ever tried tiger?
http://www.nongnu.org/tiger/
---Introduction

Tiger is a security tool that can be use both as a security audit and 
intrusion detection system. It supports multiple UNIX platforms and it 
is free and provided under a GPL license. Unlike other tools, Tiger 
needs only of POSIX tools and is written entirely in shell language. 
---------------
You can try to install APF (Firewall) and BFD (Brute Force Detection)
and also follow some of the steps outlined here:

http://www.webhostingresourcekit.com/109.html 

APF and BFD are made by rfxnetworks.com. BFD will automatically block
attackers if they fail to authenticate 5 times by using APF.
----------------
We had some similar cases before which the hackers installed irc bot
to /tmp. Besides /tmp,   "/var/tmp" and any other globally writable
directory are possible target for the intruders to download their
gadget.

I believe the root for the intrusion is very likely the web
applications running on your server, especially those cgi scripts, be
it php or perl. Also check the user rights of your web directories.
Besides disable wget and curl, you should also disable local compilers
(c and c++ at least) or limit it to root user only.  Check your apache
http access and error logs, you will find a lot of clues and even the
specific vulnerable scripts.
----------------
Don't forget /dev/shm too, or wherever your OS happens to mount it.  3+
months ago I recall seeing a seemingly automated compromise that moved
to /dev/shm after the attack using /tmp and /var/tmp failed. 

As an attacker, there are other ways to try and subvert these
protections.  There is no reason an attacker cannot `find / -type
d -perm -o=rwx` prior to download and executing their tool of choice.

I'm also a fan of mounting most partitions 'nodev' too.  If you've
already gone through the effort of mounting them 'noxec,nosuid', 'nodev'
should be a consideration too.
------------------

The telnet command goes to localhost, but you knew that.

Hopefully, your passwd file had nothing in it...

> 
> Is this normal behaviour, or do I have to worry that somebody has been
> snooping around?

Someone probably was snooping around.

Regards,
Gregory Hicks

> 
> Thank you and kind greetings,
> 
> Wim
> 

-------------------------------------------------------------------
Gregory Hicks                        | Principal Systems Engineer
Cadence Design Systems               | Direct:   408.576.3609
555 River Oaks Pkwy M/S 6B1          | Fax:      408.894.3400
San Jose, CA 95134                   | Internet: [email protected]

I am perfectly capable of learning from my mistakes.  I will surely
learn a great deal today.

"A democracy is a sheep and two wolves deciding on what to have for
lunch.  Freedom is a well armed sheep contesting the results of the
decision." - Benjamin Franklin

"The best we can hope for concerning the people at large is that they
be properly armed." --Alexander Hamilton