Step 1: Make an image of your hard drive before you start messing with
things.
I would reboot using a CD-distro (recovery CD, or knoppix) so you aren't
making any changes to your drive.
Step 2: Use RPM to see what's changed:
rpm -Va
See also http://www.sans.org/newlook/resources/IDFAQ/RPM.htm
As far as the future, compare your current results against my advice
(
http://www.georgetoft.com/linux/security/index.html, and
http://www.georgetoft.com/linux/security/locking/checklist.html) and
make the necessary adjustments. If your box was secure per my advice
(or equivalent), please let me know!!! I understand you had a web
server - did you update it recently, or was it a vulnerable version?
What other services did you have?
George
AZ Pete wrote:
>
> Hi All,
>
> I believe some kind of root kit has been installed on a server of mine. My
> first clue that things were amiss was when I logged in at the console and
> tried to do a simple 'ls' command. I got a 'permission denied' error. I
> then switched to the root user and saw that /bin/ls had permissions of
> rwx------ owner: root, group: root.
>
> I then mounted the original installation cd-rom and checked the byte size
> of the ls command within the RPM file and its file size was different than
> that on the system. The same was true for the ps command and several other
> system related utils.
>
> I've since taken this machine out of service and transferred the web
> content to another machine. So, now I can take my time to do some
> postmortem analysis. I'm confident that the web content was not 'infected',
> since they are static pages AND I took them from a known good backup anyway.
>
> I thought this would now be a good opportunity to learn what to do after an
> attack (and to prevent another one).
> If anyone can offer tips, pointers, web articles, etc. for the following:
>
> 1) How to determine if a root kit has, in fact, been installed.
> 2) How to determine the point of entry.
> 3) How to prevent this in the future.
>
> The server in question was RedHat 6.2. It a very low volume web, mail
> (SMTP and POP) and FTP server.
>
> Any thoughts/tips/pointers/etc would be greatly appreciated.
> Thanks,
> Peter
>
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)