Hi Jim,

I agree w/ the suggestion of others on the list.  Once your box is
wacked/p0wned the best thing and quickest way to get back online is by
reinstalling the OS.  I personally woulnd't bother with trying to
reconfigure or lock down a box that was known to be compromised since, as
others have mentioned, you'll be fighting an uphill battle that my never
end.

If you have data on the compromised host that needs to be kept you might
want to look at previous "known good" backups.  Last resort would be to make
a backup now, resintall the OS, and then carefully migrate or recreate the
needed data.

I've got access to commercial and freeware computer forensics tools (part of
my job) and might be able to help you create a timeline for suspicous
activity on the system if you're interested.  This depends mostly on the
size of your HD and the how big the window is between "known good" and
"known bad".   The bigger the HD and the bigger the window the more time it
will take to create an image of the HD and also to process the disk
meta-data looking for changes to files.

Let me know if I can help out.

thanks,
C.G.

On 2/22/07, Jim <arizona.anorak@gmail.com> wrote:
>
> Last night I came home from work and sat down at the computer.  I
> noticed the lights on the DSL router were blinking very rapidly.  I have
> an ftp server running on my linux box (Slackware 10.2).  So I thought
> someone might have been uploading something.
>
> Ftpwho showed no users logged in.  I checked the incoming directory and
> saw nothing there.
>
> Tcpdump showed me that they were sending something using ssh.
>
> I used find to look for anything they might have been uploading, but
> found nothing.
>
> /var/log/syslog contained the following over and over for about 4 hours
> before I got home
>
> Feb 22 20:43:56 ladmo smbd[6375]: [2007/02/22 20:43:56, 0]
> printing/print_cups.c:cups_cache_reload(85)
> Feb 22 20:43:56 ladmo smbd[6375]:   Unable to connect to CUPS server
> localhost - Connection refused
>
> Then I found in /var/log/syslog this over and over
>
> Feb 21 22:11:14 ladmo sshd[26255]: error: Could not get shadow
> information for NOUSER
>
> I stopped sshd and edited /etc/sshd_config by adding the following:
> AllowUsers root jim
> AllowGroups root
>
> To test the change, I tried to log into the server via ssh and using
> another account.  It wouldn't let me log in using that other account via
> ssh.
>
> I also tried
> find / -mmin 1200 -size +100k
> and without the size option, but found nothing from the time this was
> going on.
>
> After all this I tried to send an email, but sendmail wasn't working.  I
> backed up my sendmail config files, uninstalled sendmail, reinstalled it
> and restored the config files.  Sendmail worked after that.
>
> Is there anything else I should do?
>
> thanks
>
> --
>
>
> "That income tax you know it's nothing more than legal robbery"
> Sidney "Pa" Larkin
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>



-- 
powerofprimes@gmail.com
Carlos Macedo Gomes
_sic itur ad astra_