Re: Security question regarding root email

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dotan Cohen wrote:
I haven't read root's email in about a month. Now that I get around to
it, I am suprised to see things that I have never seen before, such
as:
 --------------------- pam_unix Begin ------------------------
 kde-np:
    Unknown Entries:
       session opened for user dotancohen by (uid=0): 1 Time(s)
 ---------------------- pam_unix End -------------------------

 --------------------- Smartd Begin ------------------------
 **Unmatched Entries**
 smartd received signal 15: Terminated
 smartd is exiting (exit status 0)
 ---------------------- Smartd End -------------------------

 --------------------- Selinux Audit Begin ------------------------
  Number of audit daemon starts: 1
  Number of audit daemon stops: 2
 *** Logs which could mean a bug ***
    major=252 name_count=0: freeing multiple contexts (1)
    major=113 name_count=0: freeing multiple contexts (2)
 ---------------------- Selinux Audit End -------------------------

 --------------------- SSHD Begin ------------------------
 SSHD Killed: 1 Time(s)
 SSHD Started: 1 Time(s)
Normal restart stuff here and in some other places.

 ---------------------- SSHD End -------------------------

 --------------------- httpd Begin ------------------------
 Requests with error response codes
    404 Not Found
       /cvs/index2.php?_REQUEST[option]=com_conte ... cho%20YYY;echo|: 1 Time(s)
       /cvs/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
       /favicon.ico: 32 Time(s)
       /javascript/HM_Arrays.js: 1 Time(s)
       /javascript/HM_ScriptDOM.js: 1 Time(s)
       /mambo/index2.php?_REQUEST[option]=com_con ... cho%20YYY;echo|: 1 Time(s)
       /php/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
 ---------------------- httpd End -------------------------

 --------------------- pam_unix Begin ------------------------
 kde:
    Unknown Entries:
       session closed for user dotancohen: 3 Time(s)
       session opened for user dotancohen by (uid=0): 3 Time(s)
This looks like you logging in and out three times.

 kde-np:
    Unknown Entries:
       session closed for user dotancohen: 3 Time(s)
       session opened for user dotancohen by (uid=0): 2 Time(s)
More, similar.
 su:
    Sessions Opened:
       (uid=500) -> root: 3 Time(s)
You becoming root/
 system-config-display:
Maybe you reconfigured your display?
    Unknown Entries:
       auth could not identify password for [root]: 1 Time(s)
 ---------------------- pam_unix End -------------------------

 --------------------- httpd Begin ------------------------
 Requests with error response codes
    403 Forbidden
       /cgi-bin/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 1 Time(s)
       /cgi-bin/awstats/awstats.pl?configdir=|ech ... cho%20YYY;echo|: 1 Time(s)

Some versions of awstats let the ungodly in. If you're not current you may have a problem,


    404 Not Found
       /Forums/admin/admin_styles.php?phpbb_root_ ... cho%20YYY;echo|: 1 Time(s)
       /Forums/admin/admin_styles.phpadmin_styles ... cho%20YYY;echo|: 1 Time(s)
       /admin_styles.phpadmin_styles.php?phpbb_ro ... cho%20YYY;echo|: 1 Time(s)

this looks like php bb stuff, some versions of which let the ungodly in.


       /awstats/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 1 Time(s)
       /blog/xmlrpc.php: 2 Time(s)
       /blog/xmlsrv/xmlrpc.php: 2 Time(s)
       /blogs/xmlsrv/xmlrpc.php: 2 Time(s)
       /cvs/index2.php?_REQUEST[option]=com_conte ... cho%20YYY;echo|: 1 Time(s)
       /cvs/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
       /drupal/xmlrpc.php: 2 Time(s)
       /mambo/index2.php?_REQUEST[option]=com_con ... cho%20YYY;echo|: 1 Time(s)
       /modules/Forums/admin/admin_styles.php?php ... cho%20YYY;echo|: 1 Time(s)
       /modules/Forums/admin/admin_styles.phpadmi ... cho%20YYY;echo|: 2 Time(s)
       /modules/coppermine/themes/default/theme.p ... cho%20YYY;echo|: 2 Time(s)
       /php/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 1 Time(s)
       /phpgroupware/xmlrpc.php: 2 Time(s)

One hopes you're in the rquisite lists for phpgroupware. I know it's big, you need to keep an eye out for problems and their fixes.


       /wordpress/xmlrpc.php: 2 Time(s)
       /xmlrpc.php: 4 Time(s)
       /xmlrpc/xmlrpc.php: 2 Time(s)
       /xmlsrv/xmlrpc.php: 2 Time(s)
 ---------------------- httpd End -------------------------

 --------------------- pam_unix Begin ------------------------
 kde-np:
    Unknown Entries:
       session closed for user dotancohen: 2 Time(s)
       session opened for user dotancohen by (uid=0): 1 Time(s)
This looks to me like you logging out.

 su:
    Sessions Opened:
       (uid=500) -> root: 3 Time(s)
this looks like you becoming root three times.

 ---------------------- pam_unix End -------------------------

These are the most suspicious. If anyone could crarify on them a bit,
i would appreciate it. Thank you!

Dotan Cohen
http://technology-sleuth.com/index.php
Hmm.


%^



--

Cheers
John

-- spambait
1aaaaaaa@xxxxxxxxxxxxxxxxxxxxxxx  Z1aaaaaaa@xxxxxxxxxxxxxxxxxxxxxxx
Tourist pics http://portgeographe.environmentaldisasters.cds.merseine.nu/

do not reply off-list


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux