Date: Thu, 30 Jul 1998 15:30:42 -0400 From: "Bob Boone" <bboone@whro.org> To: <freebsd-stable@FreeBSD.ORG> Subject: Security Issue -- Message-ID: <002e01bdbbf0$8e63eb20$ef63a8c0@wizard.whro.org>
next in thread | raw e-mail | index | archive | help
Not sure if this is the "right" place for this, but this is the list I'm on. . . . I'm a marginal Unix-person, who used FreeBSD because Apache ran on it, and it has been dependable for nearly 2-years. . . So dependable that I have not had to get deep into Unix to keep it crusin' . . . . . now I've got trouble. . . . . Running a webserver on 2.2.5 / Apache, loaded update 10/21/97, running continuously since that date. Security file this morning noted: checking setuid files and devices: www setuid diffs: 2d1 < -r-xr-sr-x 1 bin kmem 167936 Oct 21 10:15:06 1997 /bin/ps 48d46 < -r-xr-sr-x 2 bin kmem 16384 Oct 21 10:19:37 1997 /usr/bin/uptime 54d51 < -r-xr-sr-x 2 bin kmem 16384 Oct 21 10:19:37 1997 /usr/bin/w checking for uids of 0: root 0 toor 0 The "uids" have never been anything but "0" . . . . but the other lines seemed to indicate a HACK. A quick directory check showed a number of files changed between 3-6 am, some with "kmem" some with other owners. and a specific file in /bin: "libtcl76.a" -r-xr-xr-x 1 bin bin 40960 Oct 21 1997 hostname -r-xr-xr-x 1 bin bin 40960 Oct 21 1997 kill -rw-r--r-- 1 root bin 308582 Jul 30 05:41 libtcl76.a -r-xr-xr-x 1 bin bin 40960 Oct 21 1997 ln -r-xr-xr-x 1 bin bin 155648 Oct 21 1997 ls -r-xr-xr-x 1 bin bin 40960 Oct 21 1997 mkdir All password files had been updated during this time, and a user account was changed. Before I could get downstairs to the server, the "libtcl76.a" file dissappeared. My "messages" log was deleted, and there were no httpd-access or -error entries for that period of time . . . Like an "alien" abduction, all overt evidence was erased, but I expect this is a more common "earthly" problem than that. . . . There was one last entry on the terminal screen, that a mail error had occurred from "noc.ipspeed.net" -- they show up in internic as a new ISP in california (I'm on the east coast), so they should not have been the last bounce for mail to me, and I'm not sure what connection, if any, they are to my other problem . . . QUESTIONS: (1) Is this a known hack ??? (2) What else should I assume is corrupt, beyond password and user files. And how do I "delete" a user . . . sysinstall lets me ADD, but not DELETE, and when it adds it puts stuff in several different files, so I assume I'll need to go to each of these areas to delete the specific user-info . . . . ?? (3) What do I do to keep it from happening again ??? ============================================================ Bob Boone Chief Engineer,TV & Radio (Studios) WHRO-TV/FM Norfolk, Va. bboone@whro.org PH: 757.889.9466 FX: 757.489.4444 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?002e01bdbbf0$8e63eb20$ef63a8c0>