LinuxForum.Fans
Тема

Ломанули сервер

Автор: ERT 90 сообщений 15161 просмотров
#197550

Здравствуйте!
У меня проблема - ломанули сервер. Сменили владельца всех директорий и файлов на 0:0, в var/www - 1000:1000. Под root'om не могу ничего сделать на сервере и в папку root зайти не могу.
Днем ранее удалили все файлы, которые принадлежали пользователю. Я все восстановил и сменил все пароли.
Подскажите что делать? Если переустановка всей системы, то как ее защитить от подобного (не знаю как назвать это).
Заранее благодарен.

#197556

Взломщик вернул все права назад. Не знаю по какой причине, видимо показать, что сервер не защищен.
Буду читать. спасибо.

#197562

Как взломали?
Логи?!

#197563
newzenon написал:
Логи?!

почистили :D

#197564

Насколько я помню у ERT ssh наружу открыт был, закрыть, или fail2ban поставить к примеру, ну и да в iptables логирование настроить с к примеру отправкой логов на почту.

#197568
ERT написал:
Установил rkhunter-1.3.8, есть лог. Показать? Поможете?

показывай, только под спойлер спрячь =)

#197570

ERT, ну сообща и попробуем разглядеть, только надо как-бы определить как собственно взломали?
rkhunter ищет руткиты, но например если ssh взломан, то толку-то.
Выкладывай конечно, все что есть, в /var/log что нибудь осталось?
ы. Я не помню куда апач логи доступа складирует, то же заглянуть.

#197571

Вот:

Показать
[12:44:26] Running Rootkit Hunter version 1.3.8 on evolutiongame
[12:44:26]
[12:44:26] Info: Start date is Вто Окт 4 12:44:26 EEST 2011
[12:44:26]
[12:44:26] Checking configuration file and command-line options...
[12:44:26] Info: Detected operating system is 'Linux'
[12:44:26] Info: Found O/S name: Debian 6.0.2
[12:44:26] Info: Command line is /usr/local/bin/rkhunter -c -sk
[12:44:26] Info: Environment shell is /bin/bash; rkhunter is using dash
[12:44:26] Info: Using configuration file '/etc/rkhunter.conf'
[12:44:26] Info: Installation directory is '/usr'
[12:44:26] Info: Using language 'en'
[12:44:26] Info: Using '/var/lib/rkhunter/db' as the database directory
[12:44:26] Info: Using '/usr/share/rkhunter/scripts' as the support script directory
[12:44:26] Info: Using '/usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /sbin /bin' as the command directories
[12:44:26] Info: Using '/' as the root directory by default
[12:44:26] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
[12:44:26] Info: No mail-on-warning address configured
[12:44:26] Info: X will be automatically detected
[12:44:26] Info: Found the 'basename' command: /usr/bin/basename
[12:44:26] Info: Found the 'diff' command: /usr/bin/diff
[12:44:26] Info: Found the 'dirname' command: /usr/bin/dirname
[12:44:26] Info: Found the 'file' command: /usr/bin/file
[12:44:26] Info: Found the 'find' command: /usr/bin/find
[12:44:26] Info: Found the 'ifconfig' command: /sbin/ifconfig
[12:44:26] Info: Found the 'ip' command: /sbin/ip
[12:44:26] Info: Found the 'ldd' command: /usr/bin/ldd
[12:44:26] Info: Found the 'lsattr' command: /usr/bin/lsattr
[12:44:26] Info: Found the 'lsmod' command: /sbin/lsmod
[12:44:26] Info: Found the 'lsof' command: /usr/bin/lsof
[12:44:26] Info: Found the 'mktemp' command: /bin/mktemp
[12:44:26] Info: Found the 'netstat' command: /bin/netstat
[12:44:26] Info: Found the 'perl' command: /usr/bin/perl
[12:44:26] Info: Found the 'pgrep' command: /usr/bin/pgrep
[12:44:26] Info: Found the 'ps' command: /bin/ps
[12:44:26] Info: Found the 'pwd' command: /bin/pwd
[12:44:26] Info: Found the 'readlink' command: /bin/readlink
[12:44:26] Info: Found the 'stat' command: /usr/bin/stat
[12:44:26] Info: Found the 'strings' command: /usr/bin/strings
[12:44:26] Info: System is not using prelinking
[12:44:26] Info: Using the '/usr/bin/sha1sum' command for the file hash checks
[12:44:26] Info: Stored hash values used hash function '/usr/bin/sha1sum'
[12:44:26] Info: Stored hash values did not use a package manager
[12:44:26] Info: The hash function field index is set to 1
[12:44:26] Info: No package manager specified: using hash function '/usr/bin/sha1sum'
[12:44:26] Info: Previous file attributes were stored
[12:44:26] Info: Enabled tests are: all
[12:44:26] Info: Disabled tests are: suspscan hidden_procs deleted_files packet_cap_apps apps
[12:44:26] Info: Found ksym file '/proc/kallsyms'
[12:44:26] Info: Using 'date' to process epoch second times.
[12:44:26]
[12:44:26] Checking if the O/S has changed since last time...
[12:44:27] Info: Nothing seems to have changed.
[12:44:27] Info: Locking is not being used
[12:44:27]
[12:44:27] Starting system checks...
[12:44:27]
[12:44:27] Info: Starting test name 'system_commands'
[12:44:27] Checking system commands...
[12:44:27]
[12:44:27] Info: Starting test name 'strings'
[12:44:27] Performing 'strings' command checks
[12:44:27] Scanning for string /usr/sbin/ntpsx [ OK ]
[12:44:27] Scanning for string /usr/sbin/.../bkit-ava [ OK ]
[12:44:27] Scanning for string /usr/sbin/.../bkit-d [ OK ]
[12:44:27] Scanning for string /usr/sbin/.../bkit-shd [ OK ]
[12:44:27] Scanning for string /usr/sbin/.../bkit-f [ OK ]
[12:44:27] Scanning for string /usr/include/.../proc.h [ OK ]
[12:44:27] Scanning for string /usr/include/.../.bash_history [ OK ]
[12:44:27] Scanning for string /usr/include/.../bkit-get [ OK ]
[12:44:27] Scanning for string /usr/include/.../bkit-dl [ OK ]
[12:44:27] Scanning for string /usr/include/.../bkit-screen [ OK ]
[12:44:27] Scanning for string /usr/include/.../bkit-sleep [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-adore.o [ OK ]
[12:44:27] Scanning for string /usr/lib/.../ls [ OK ]
[12:44:27] Scanning for string /usr/lib/.../netstat [ OK ]
[12:44:27] Scanning for string /usr/lib/.../lsof [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh/bkit-shdcfg [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh/bkit-shhk [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh/bkit-pw [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh/bkit-shrs [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh/bkit-mots [ OK ]
[12:44:27] Scanning for string /usr/lib/.../uconf.inv [ OK ]
[12:44:27] Scanning for string /usr/lib/.../psr [ OK ]
[12:44:27] Scanning for string /usr/lib/.../find [ OK ]
[12:44:27] Scanning for string /usr/lib/.../pstree [ OK ]
[12:44:27] Scanning for string /usr/lib/.../slocate [ OK ]
[12:44:27] Scanning for string /usr/lib/.../du [ OK ]
[12:44:27] Scanning for string /usr/lib/.../top [ OK ]
[12:44:27] Scanning for string /usr/sbin/... [ OK ]
[12:44:27] Scanning for string /usr/include/... [ OK ]
[12:44:27] Scanning for string /usr/include/.../.tmp [ OK ]
[12:44:27] Scanning for string /usr/lib/... [ OK ]
[12:44:27] Scanning for string /usr/lib/.../.ssh [ OK ]
[12:44:27] Scanning for string /usr/lib/.../bkit-ssh [ OK ]
[12:44:27] Scanning for string /usr/lib/.bkit- [ OK ]
[12:44:27] Scanning for string /tmp/.bkp [ OK ]
[12:44:27] Scanning for string /tmp/.cinik [ OK ]
[12:44:27] Scanning for string /tmp/.font-unix/.cinik [ OK ]
[12:44:27] Scanning for string /lib/.sso [ OK ]
[12:44:27] Scanning for string /lib/.so [ OK ]
[12:44:27] Scanning for string /var/run/...dica/clean [ OK ]
[12:44:27] Scanning for string /var/run/...dica/dxr [ OK ]
[12:44:28] Scanning for string /var/run/...dica/read [ OK ]
[12:44:28] Scanning for string /var/run/...dica/write [ OK ]
[12:44:28] Scanning for string /var/run/...dica/lf [ OK ]
[12:44:28] Scanning for string /var/run/...dica/xl [ OK ]
[12:44:28] Scanning for string /var/run/...dica/xdr [ OK ]
[12:44:28] Scanning for string /var/run/...dica/psg [ OK ]
[12:44:28] Scanning for string /var/run/...dica/secure [ OK ]
[12:44:28] Scanning for string /var/run/...dica/rdx [ OK ]
[12:44:28] Scanning for string /var/run/...dica/va [ OK ]
[12:44:28] Scanning for string /var/run/...dica/cl.sh [ OK ]
[12:44:28] Scanning for string /var/run/...dica/last.log [ OK ]
[12:44:28] Scanning for string /usr/bin/.etc [ OK ]
[12:44:28] Scanning for string /etc/sshd_config [ OK ]
[12:44:28] Scanning for string /etc/ssh_host_key [ OK ]
[12:44:28] Scanning for string /etc/ssh_random_seed [ OK ]
[12:44:28] Scanning for string /dev/ptyp [ OK ]
[12:44:28] Scanning for string /dev/ptyq [ OK ]
[12:44:28] Scanning for string /dev/ptyr [ OK ]
[12:44:28] Scanning for string /dev/ptys [ OK ]
[12:44:28] Scanning for string /dev/ptyt [ OK ]
[12:44:28] Scanning for string /dev/fd/.88/freshb-bsd [ OK ]
[12:44:28] Scanning for string /dev/fd/.88/fresht [ OK ]
[12:44:28] Scanning for string /dev/fd/.88/zxsniff [ OK ]
[12:44:28] Scanning for string /dev/fd/.88/zxsniff.log [ OK ]
[12:44:28] Scanning for string /dev/fd/.99/.ttyf00 [ OK ]
[12:44:28] Scanning for string /dev/fd/.99/.ttyp00 [ OK ]
[12:44:28] Scanning for string /dev/fd/.99/.ttyq00 [ OK ]
[12:44:28] Scanning for string /dev/fd/.99/.ttys00 [ OK ]
[12:44:28] Scanning for string /dev/fd/.99/.pwsx00 [ OK ]
[12:44:28] Scanning for string /etc/.acid [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/sched_host.2 [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/random_d.2 [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/set_pid.2 [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/setrgrp.2 [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/TOHIDE [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/cons.saver [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/adore/ava/ava [ OK ]
[12:44:28] Scanning for string /usr/lib/.fx/adore/adore/adore.ko [ OK ]
[12:44:28] Scanning for string /bin/sysback [ OK ]
[12:44:28] Scanning for string /usr/local/bin/sysback [ OK ]
[12:44:28] Scanning for string /usr/lib/.tbd [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/t0rns [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/du [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/ls [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/t0rnsb [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/ps [ OK ]
[12:44:28] Scanning for string /dev/.lib/lib/lib/t0rnp [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/find [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/ifconfig [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/pg [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/ssh.tgz [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/top [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/sz [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/login [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/in.fingerd [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/1i0n.sh [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/pstree [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/in.telnetd [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/mjy [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/sush [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/tfn [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/name [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/getip.sh [ OK ]
[12:44:29] Scanning for string /usr/info/.torn/sh* [ OK ]
[12:44:29] Scanning for string /usr/src/.puta/.1addr [ OK ]
[12:44:29] Scanning for string /usr/src/.puta/.1file [ OK ]
[12:44:29] Scanning for string /usr/src/.puta/.1proc [ OK ]
[12:44:29] Scanning for string /usr/src/.puta/.1logz [ OK ]
[12:44:29] Scanning for string /usr/info/.t0rn [ OK ]
[12:44:29] Scanning for string /dev/.lib [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/lib/dev [ OK ]
[12:44:29] Scanning for string /dev/.lib/lib/scan [ OK ]
[12:44:29] Scanning for string /usr/src/.puta [ OK ]
[12:44:29] Scanning for string /usr/man/man1/man1 [ OK ]
[12:44:29] Scanning for string /usr/man/man1/man1/lib [ OK ]
[12:44:29] Scanning for string /usr/man/man1/man1/lib/.lib [ OK ]
[12:44:29] Scanning for string /usr/man/man1/man1/lib/.lib/.backup [ OK ]
[12:44:29]
[12:44:29] Info: Starting test name 'shared_libs'
[12:44:29] Performing 'shared libraries' checks
[12:44:29] Checking for preloading variables [ None found ]
[12:44:29] Checking for preloaded libraries [ None found ]
[12:44:29]
[12:44:29] Info: Starting test name 'shared_libs_path'
[12:44:29] Checking LD_LIBRARY_PATH variable [ Not found ]
[12:44:29]
[12:44:29] Info: Starting test name 'properties'
[12:44:29] Performing file properties checks
[12:44:29] Checking for prerequisites [ OK ]
[12:44:31] /usr/local/bin/rkhunter [ Warning ]
[12:44:31] Warning: The file '/usr/local/bin/rkhunter' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:32] /usr/sbin/adduser [ OK ]
[12:44:32] Info: Found file '/usr/sbin/adduser': it is whitelisted for the 'script replacement' check.
[12:44:32] /usr/sbin/chroot [ OK ]
[12:44:32] /usr/sbin/cron [ OK ]
[12:44:32] /usr/sbin/groupadd [ OK ]
[12:44:32] /usr/sbin/groupdel [ OK ]
[12:44:32] /usr/sbin/groupmod [ OK ]
[12:44:32] /usr/sbin/grpck [ OK ]
[12:44:32] /usr/sbin/nologin [ OK ]
[12:44:33] /usr/sbin/pwck [ OK ]
[12:44:33] /usr/sbin/rsyslogd [ OK ]
[12:44:33] /usr/sbin/tcpd [ OK ]
[12:44:33] /usr/sbin/useradd [ OK ]
[12:44:33] /usr/sbin/userdel [ OK ]
[12:44:33] /usr/sbin/usermod [ OK ]
[12:44:33] /usr/sbin/vipw [ OK ]
[12:44:33] /usr/sbin/unhide [ Warning ]
[12:44:33] Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:33] /usr/sbin/unhide-tcp [ Warning ]
[12:44:33] Warning: The file '/usr/sbin/unhide-tcp' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:34] /usr/sbin/unhide-linux26 [ OK ]
[12:44:34] /usr/bin/awk [ OK ]
[12:44:34] /usr/bin/basename [ OK ]
[12:44:34] /usr/bin/chattr [ OK ]
[12:44:34] /usr/bin/cut [ OK ]
[12:44:34] /usr/bin/diff [ OK ]
[12:44:34] /usr/bin/dirname [ OK ]
[12:44:34] /usr/bin/dpkg [ OK ]
[12:44:34] /usr/bin/dpkg-query [ OK ]
[12:44:34] /usr/bin/du [ OK ]
[12:44:34] /usr/bin/env [ OK ]
[12:44:34] /usr/bin/file [ OK ]
[12:44:34] /usr/bin/find [ OK ]
[12:44:34] /usr/bin/GET [ Warning ]
[12:44:35] Warning: The file '/usr/bin/GET' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:35] /usr/bin/groups [ OK ]
[12:44:35] Info: Found file '/usr/bin/groups': it is whitelisted for the 'script replacement' check.
[12:44:35] /usr/bin/head [ OK ]
[12:44:35] /usr/bin/id [ OK ]
[12:44:35] /usr/bin/killall [ OK ]
[12:44:35] /usr/bin/last [ OK ]
[12:44:35] /usr/bin/lastlog [ OK ]
[12:44:35] /usr/bin/ldd [ OK ]
[12:44:35] Info: Found file '/usr/bin/ldd': it is whitelisted for the 'script replacement' check.
[12:44:35] /usr/bin/less [ OK ]
[12:44:35] /usr/bin/locate [ OK ]
[12:44:35] /usr/bin/logger [ OK ]
[12:44:35] /usr/bin/lsattr [ OK ]
[12:44:35] /usr/bin/lsof [ OK ]
[12:44:35] /usr/bin/mail [ OK ]
[12:44:36] /usr/bin/md5sum [ OK ]
[12:44:36] /usr/bin/mlocate [ Warning ]
[12:44:36] Warning: The file properties have changed:
[12:44:36] File: /usr/bin/mlocate
[12:44:36] Current permissions: 2755 Stored permissions: 02755
[12:44:36] /usr/bin/newgrp [ Warning ]
[12:44:36] Warning: The file properties have changed:
[12:44:36] File: /usr/bin/newgrp
[12:44:36] Current permissions: 4755 Stored permissions: 04755
[12:44:36] /usr/bin/passwd [ Warning ]
[12:44:36] Warning: The file properties have changed:
[12:44:36] File: /usr/bin/passwd
[12:44:36] Current permissions: 4755 Stored permissions: 04755
[12:44:36] /usr/bin/perl [ OK ]
[12:44:36] /usr/bin/pgrep [ OK ]
[12:44:36] /usr/bin/pstree [ OK ]
[12:44:36] /usr/bin/rkhunter [ OK ]
[12:44:36] /usr/bin/runcon [ OK ]
[12:44:36] /usr/bin/sha1sum [ OK ]
[12:44:36] /usr/bin/sha224sum [ OK ]
[12:44:37] /usr/bin/sha256sum [ OK ]
[12:44:37] /usr/bin/sha384sum [ OK ]
[12:44:37] /usr/bin/sha512sum [ OK ]
[12:44:37] /usr/bin/size [ OK ]
[12:44:37] /usr/bin/sort [ OK ]
[12:44:37] /usr/bin/stat [ OK ]
[12:44:37] /usr/bin/strings [ OK ]
[12:44:37] /usr/bin/sudo [ Warning ]
[12:44:37] Warning: The file properties have changed:
[12:44:37] File: /usr/bin/sudo
[12:44:37] Current permissions: 4755 Stored permissions: 04755
[12:44:37] /usr/bin/tail [ OK ]
[12:44:37] /usr/bin/test [ OK ]
[12:44:37] /usr/bin/top [ OK ]
[12:44:37] /usr/bin/touch [ OK ]
[12:44:37] /usr/bin/tr [ OK ]
[12:44:37] /usr/bin/uniq [ OK ]
[12:44:38] /usr/bin/users [ OK ]
[12:44:38] /usr/bin/vmstat [ OK ]
[12:44:38] /usr/bin/w [ OK ]
[12:44:38] /usr/bin/watch [ OK ]
[12:44:38] /usr/bin/wc [ OK ]
[12:44:38] /usr/bin/wget [ OK ]
[12:44:38] /usr/bin/whatis [ OK ]
[12:44:38] /usr/bin/whereis [ OK ]
[12:44:38] /usr/bin/which [ OK ]
[12:44:38] /usr/bin/who [ OK ]
[12:44:38] /usr/bin/whoami [ OK ]
[12:44:38] /usr/bin/mawk [ OK ]
[12:44:38] /usr/bin/lwp-request [ Warning ]
[12:44:38] Warning: The file '/usr/bin/lwp-request' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:38] Info: Found file '/usr/bin/lwp-request': it is whitelisted for the 'script replacement' check.
[12:44:38] /usr/bin/bsd-mailx [ OK ]
[12:44:38] /usr/bin/w.procps [ OK ]
[12:44:39] /sbin/depmod [ OK ]
[12:44:39] /sbin/fsck [ Warning ]
[12:44:39] Warning: The file '/sbin/fsck' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:39] /sbin/ifconfig [ OK ]
[12:44:39] /sbin/ifdown [ OK ]
[12:44:39] /sbin/ifup [ OK ]
[12:44:39] /sbin/init [ OK ]
[12:44:39] /sbin/insmod [ OK ]
[12:44:39] /sbin/ip [ OK ]
[12:44:39] /sbin/lsmod [ OK ]
[12:44:39] /sbin/modinfo [ OK ]
[12:44:40] /sbin/modprobe [ OK ]
[12:44:40] /sbin/rmmod [ OK ]
[12:44:40] /sbin/route [ Warning ]
[12:44:40] Warning: The file '/sbin/route' exists on the system, but it is not present in the rkhunter.dat file.
[12:44:40] /sbin/runlevel [ OK ]
[12:44:40] /sbin/sulogin [ OK ]
[12:44:40] /sbin/sysctl [ OK ]
[12:44:40] /bin/bash [ OK ]
[12:44:40] /bin/cat [ OK ]
[12:44:41] /bin/chmod [ OK ]
[12:44:41] /bin/chown [ OK ]
[12:44:41] /bin/cp [ OK ]
[12:44:41] /bin/date [ OK ]
[12:44:41] /bin/df [ OK ]
[12:44:41] /bin/dmesg [ OK ]
[12:44:41] /bin/echo [ OK ]
[12:44:41] /bin/egrep [ OK ]
[12:44:41] Info: Found file '/bin/egrep': it is whitelisted for the 'script replacement' check.
[12:44:41] /bin/fgrep [ OK ]
[12:44:41] Info: Found file '/bin/fgrep': it is whitelisted for the 'script replacement' check.
[12:44:41] /bin/fuser [ OK ]
[12:44:41] /bin/grep [ OK ]
[12:44:41] /bin/ip [ OK ]
[12:44:42] /bin/kill [ OK ]
[12:44:42] /bin/less [ OK ]
[12:44:42] /bin/login [ OK ]
[12:44:42] /bin/ls [ OK ]
[12:44:42] /bin/lsmod [ OK ]
[12:44:42] /bin/mktemp [ OK ]
[12:44:42] /bin/more [ OK ]
[12:44:42] /bin/mount [ Warning ]
[12:44:42] Warning: The file properties have changed:
[12:44:42] File: /bin/mount
[12:44:42] Current permissions: 4755 Stored permissions: 04755
[12:44:42] /bin/mv [ OK ]
[12:44:42] /bin/netstat [ OK ]
[12:44:42] /bin/ps [ OK ]
[12:44:42] /bin/pwd [ OK ]
[12:44:42] /bin/readlink [ OK ]
[12:44:43] /bin/sed [ OK ]
[12:44:43] /bin/sh [ OK ]
[12:44:43] /bin/su [ Warning ]
[12:44:43] Warning: The file properties have changed:
[12:44:43] File: /bin/su
[12:44:43] Current permissions: 4755 Stored permissions: 04755
[12:44:43] /bin/touch [ OK ]
[12:44:43] /bin/uname [ OK ]
[12:44:43] /bin/which [ OK ]
[12:44:43] Info: Found file '/bin/which': it is whitelisted for the 'script replacement' check.
[12:44:43] /bin/dash [ OK ]
[12:44:43]
[12:44:43] Info: Starting test name 'rootkits'
[12:44:43] Checking for rootkits...
[12:44:44]
[12:44:44] Info: Starting test name 'known_rkts'
[12:44:44] Performing check of known rootkit files and directories
[12:44:44]
[12:44:44] Checking for 55808 Trojan - Variant A...
[12:44:44] Checking for file '/tmp/.../r' [ Not found ]
[12:44:44] Checking for file '/tmp/.../a' [ Not found ]
[12:44:44] 55808 Trojan - Variant A [ Not found ]
[12:44:44]
[12:44:44] Checking for ADM Worm...
[12:44:44] Checking for string 'w0rm' [ Not found ]
[12:44:44] ADM Worm [ Not found ]
[12:44:44]
[12:44:44] Checking for AjaKit Rootkit...
[12:44:44] Checking for file '/dev/tux/.addr' [ Not found ]
[12:44:44] Checking for file '/dev/tux/.proc' [ Not found ]
[12:44:44] Checking for file '/dev/tux/.file' [ Not found ]
[12:44:44] Checking for file '/lib/.libgh-gh/cleaner' [ Not found ]
[12:44:44] Checking for file '/lib/.libgh-gh/Patch/patch' [ Not found ]
[12:44:44] Checking for file '/lib/.libgh-gh/sb0k' [ Not found ]
[12:44:44] Checking for directory '/dev/tux' [ Not found ]
[12:44:44] Checking for directory '/lib/.libgh-gh' [ Not found ]
[12:44:44] AjaKit Rootkit [ Not found ]
[12:44:44]
[12:44:44] Checking for Adore Rootkit...
[12:44:44] Checking for file '/usr/secure' [ Not found ]
[12:44:44] Checking for file '/usr/doc/sys/qrt' [ Not found ]
[12:44:44] Checking for file '/usr/doc/sys/run' [ Not found ]
[12:44:44] Checking for file '/usr/doc/sys/crond' [ Not found ]
[12:44:44] Checking for file '/usr/sbin/kfd' [ Not found ]
[12:44:44] Checking for file '/usr/doc/kern/var' [ Not found ]
[12:44:44] Checking for file '/usr/doc/kern/string.o' [ Not found ]
[12:44:44] Checking for file '/usr/doc/kern/ava' [ Not found ]
[12:44:44] Checking for file '/usr/doc/kern/adore.o' [ Not found ]
[12:44:44] Checking for file '/var/log/ssh/old' [ Not found ]
[12:44:44] Checking for directory '/lib/security/.config/ssh' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/kern' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/backup' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/backup/txt' [ Not found ]
[12:44:44] Checking for directory '/lib/backup' [ Not found ]
[12:44:44] Checking for directory '/lib/backup/txt' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/work' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/sys' [ Not found ]
[12:44:44] Checking for directory '/var/log/ssh' [ Not found ]
[12:44:44] Checking for directory '/usr/doc/.spool' [ Not found ]
[12:44:44] Checking for directory '/usr/lib/kterm' [ Not found ]
[12:44:44] Adore Rootkit [ Not found ]
[12:44:44]
[12:44:44] Checking for aPa Kit...
[12:44:44] Checking for file '/usr/share/.aPa' [ Not found ]
[12:44:44] aPa Kit [ Not found ]
[12:44:44]
[12:44:44] Checking for Apache Worm...
[12:44:44] Checking for file '/bin/.log' [ Not found ]
[12:44:44] Apache Worm [ Not found ]

Весь не влазит. Ограничение по количеству символов в сообщении на форуме. Остальное отправить следующим сообщением?

#197573

newzenon, все логи на месте кажись. Что именно нужно показать?

#197574

/var/log/messages или /var/log/auth.log есть?

#197577
newzenon написал:
/var/log/auth.log

файла может и не быть, а вот так все возможно: /var/log/audit/auth.log , да и еще бы глянуть на bash_history возможэно там что то есть, хотя я в этом совневаюсь.
ERT, rkhunter ни чего показал.

newzenon написал:
Я не помню куда апач логи доступа складирует

access.log должен складывать.

#197581

Или /var/log/auth сейчас debian нет под рукой.

#197583

Оно?? 80.53.125.66 - кто это?

text
Oct  4 09:04:41 evolutiongame sshd[26321]: Invalid user test from 80.53.125.66
Oct  4 09:04:41 evolutiongame sshd[26321]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:41 evolutiongame sshd[26321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:04:44 evolutiongame sshd[26321]: Failed password for invalid user test from 80.53.125.66 port 51291 ssh2
Oct  4 09:04:44 evolutiongame sshd[26324]: Invalid user test from 80.53.125.66
Oct  4 09:04:44 evolutiongame sshd[26324]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:44 evolutiongame sshd[26324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:04:46 evolutiongame sshd[26324]: Failed password for invalid user test from 80.53.125.66 port 51353 ssh2
Oct  4 09:04:47 evolutiongame sshd[26326]: Invalid user test from 80.53.125.66
Oct  4 09:04:47 evolutiongame sshd[26326]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:47 evolutiongame sshd[26326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:04:49 evolutiongame sshd[26326]: Failed password for invalid user test from 80.53.125.66 port 51402 ssh2
Oct  4 09:04:49 evolutiongame sshd[26328]: Invalid user test from 80.53.125.66
Oct  4 09:04:49 evolutiongame sshd[26328]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:49 evolutiongame sshd[26328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:04:52 evolutiongame sshd[26328]: Failed password for invalid user test from 80.53.125.66 port 51436 ssh2
Oct  4 09:04:53 evolutiongame sshd[26330]: Invalid user test from 80.53.125.66
Oct  4 09:04:53 evolutiongame sshd[26330]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:53 evolutiongame sshd[26330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:04:55 evolutiongame sshd[26330]: Failed password for invalid user test from 80.53.125.66 port 51480 ssh2
Oct  4 09:04:56 evolutiongame sshd[26332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl  user=root
Oct  4 09:04:58 evolutiongame sshd[26332]: Failed password for root from 80.53.125.66 port 51523 ssh2
Oct  4 09:04:59 evolutiongame sshd[26334]: Invalid user test from 80.53.125.66
Oct  4 09:04:59 evolutiongame sshd[26334]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:04:59 evolutiongame sshd[26334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:05:00 evolutiongame sshd[26334]: Failed password for invalid user test from 80.53.125.66 port 51550 ssh2
Oct  4 09:05:01 evolutiongame sshd[26336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl  user=root
Oct  4 09:05:03 evolutiongame sshd[26336]: Failed password for root from 80.53.125.66 port 51576 ssh2
Oct  4 09:05:04 evolutiongame sshd[26338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl  user=root
Oct  4 09:05:06 evolutiongame sshd[26338]: Failed password for root from 80.53.125.66 port 51595 ssh2
Oct  4 09:05:07 evolutiongame sshd[26340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl  user=root
Oct  4 09:05:09 evolutiongame sshd[26340]: Failed password for root from 80.53.125.66 port 51638 ssh2
Oct  4 09:05:10 evolutiongame sshd[26342]: Invalid user x from 80.53.125.66
Oct  4 09:05:10 evolutiongame sshd[26342]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:05:10 evolutiongame sshd[26342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:05:12 evolutiongame sshd[26342]: Failed password for invalid user x from 80.53.125.66 port 51691 ssh2
Oct  4 09:05:13 evolutiongame sshd[26345]: Invalid user test from 80.53.125.66
Oct  4 09:05:13 evolutiongame sshd[26345]: pam_unix(sshd:auth): check pass; user unknown
Oct  4 09:05:13 evolutiongame sshd[26345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl 
Oct  4 09:05:15 evolutiongame sshd[26345]: Failed password for invalid user test from 80.53.125.66 port 51725 ssh2
Oct  4 09:05:16 evolutiongame sshd[26348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=iv66.internetdsl.tpnet.pl  user=root
Oct  4 09:05:18 evolutiongame sshd[26348]: Failed password for root from 80.53.125.66 port 51781 ssh2
Oct  4 09:09:01 evolutiongame CRON[26379]: pam_unix(cron:session): session opened for user root by (uid=0)
Oct  4 09:09:01 evolutiongame CRON[26379]: pam_unix(cron:session): session closed for user root
Oct  4 09:17:01 evolutiongame CRON[26443]: pam_unix(cron:session): session opened for user root by (uid=0)
Oct  4 09:17:01 evolutiongame CRON[26443]: pam_unix(cron:session): session closed for user root
Oct  4 09:18:01 evolutiongame CRON[26448]: pam_unix(cron:session): session opened for user amavis by (uid=0)
Oct  4 09:18:01 evolutiongame CRON[26448]: pam_unix(cron:session): session closed for user amavis
Oct  4 09:30:01 evolutiongame CRON[26539]: pam_unix(cron:session): session opened for user root by (uid=0)
Oct  4 09:30:01 evolutiongame CRON[26539]: pam_unix(cron:session): session closed for user root
#197586

Бань пока IP-шник этот, предварительно записав в лог попытку.

text
iptables -A INPUT -s 80.53.125.66 -j LOG --log-prefix "IP 80.53.125.66 DROP:"
iptables -A INPUT -s 80.53.125.66 -j DROP
#197588

Не знаю. Со вчерашнего дня сменил пароль, теперь его знаю только я один (до этого еще 3 человека и то пасс пользователя, не root). Я захожу, на данный момент, под локальным IP 192.168.0.2 и из дому 10.72.x.x

#197590

Забанил IP. По такому принципу и все остальные можно банить как я понял?
Вчера смотрел лог и там еще около пяти IP-адресов, которые подбирали pass к серверу.

#197591

На каком порте ssh у тебя?
По логу видны попытки получения root доступа с адреса 80.53.125.66, которые судя по всему увенчались успехом.

Войдите или зарегистрируйтесь, чтобы ответить.