Carl, On Wednesday 03 January 2007 08:51, Carl Hartung wrote:

On Wednesday 03 January 2007 10:38, Randall R Schulz wrote: <snipped an *awesome* reply for my 'kit bag'>

Thanks a lot Randall, I really appreciate the feedback.

I'm booted into a fresh 10.2 right now and 'who' works as expected.

The problem is I can't remember how long ago it was I interrupted an actual break-in into my 10.0 system. Someone 'cracked' <roll eyes> the ISP-supplied DSL modem 'Admin' 'Password' hurdle and logged into my box via ssh. (I honestly didn't even know this existed! It was delivered as a 'modem'... the routing functions weren't discussed anywhere in the supplied literature and the default config had the built-in NAT-based firewall turned *off*!)

Any good router or modem that is smart enough to have an administrative interface should have an option to prevent logging in from the outside (the "wild" Internet) and to accept administrative logins and commands only from the interior side. Unless you really need to do remote administration, you should find and disable the remote administrative access entirely.

This is when I discovered that 'who' wasn't working correctly and suspected someone was logged in, I immediately physically severed the net connection at the modem and upgraded everything to *really long* passwords plus a very complex router 'Admin' name.

The utmp corruption could well have been a deliberate attempt to obscure the intruder's presense.

I also disabled remote root logins into my box and installed rkhunter. All subsequent scans have been either 'OK' or 'clean'.

I never see unusual network activity at the router LEDs or in ntop or netstat, but I haven't been able to restore 'who' to it's former glory and my confidence level in the security of that installation isn't back to normal.

Utmp and wtmp only record successful logins. You can see failed attempts, including ssh attemptws, in /var/log/messages.

So, thanks again for the clues, Randall. Much appreciated!

Pro noblemo.

Carl

RRS -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wednesday 03 January 2007 10:43, Kenneth Schneider wrote:

Try the "w" command (without the quotes) and see what it returns. Also type alias to make sure the an alias has not been introduced into the system.

Thanks for the ideas, Ken, and happy new year! I'll post all the 'forensics' results from everyone's feedback after I've booted back into 10.0 regards, Carl -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wednesday 03 January 2007 10:55, Randall R Schulz wrote:

My previous answer was for part (a). For part (b) I'd check on /var/run/utmp. That file records current logins. Perhaps the file is missing or damaged. If it's missing, it should get recreated by a reboot. If it's corrupted, perhaps it should be removed and then you should reboot.

Actually, a bit of quick Googling suggests that the proper way to correct a corrupted utmp is to copy /dev/null onto it (or otherwise effect its truncation) and not to reboot but merely to log out and in again.

Thanks for the addendum, Randall. I've added it to my notes for when I tackle the 'errant who' issue later today. I'm enjoying exploring 10.2 right now! :-) regards, Carl -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, 2007-01-03 at 20:26 -0500, Carl Hartung wrote:

On Wednesday 03 January 2007 10:27, Carl Hartung wrote: <snipped; I'm replying to all who responded to my original post>

Hi All,

I'd forgotten I'd turned off sshd and apache2 immediately after the incident and only begun firing them up when needed. There must be an unknown mechanism affording access to the system. :-(

If you even slightly suspect some problem I highly recommend saving any data you can and doing a fresh install on this machine. Better to be safe then sorry.

With respect to today's tests:

First, after booting back into 10.0, 'who' was working correctly. (!?) After seeing this, I didn't bother checking the status of /var/run/utmp

Remote administration was still disabled in the router, it's firewall settings were still where I'd set them and my very long & complex 'Admin' names and password were still intact. I'm beginning to suspect some kind of "inside attack" is being routed through the M$ box that is sharing this connection.

I saw nothing unusual with "last", "w" or "alias".

If the [u,w]tmp file is corrupt in any way you will get faulty results when using these commands. Perhaps you fixed the problem by either zeroing out the file with "> /var/log/[u,w]tmp" or by deleting it which caused it to be recreated. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org