Language Selection

English French German Italian Portuguese Spanish

A strangely compromised Linux box

Filed under
Linux
Security

A customer reported that a Linux machine used for ssh access (to in turn give telnet access to an ancient SCO machine) was refusing logins. I asked him to try logging in as root at the console; he was unable to do so.

When I arrived on site, I found that I could not login as he had said. I rebooted to single use mode and started peeking around. The machine had been hacked; there was little doubt about that. It's HOW it was hacked that bothers me,

First, there was no attempt to hide any evidence. I could see in wtmp and the secure logs that someone had logged in from a German ISP address, attained su status, and created a new su user for himself. He then changed root's password.

Fine so far, right? But then he did something very strange. He hand edited /etc/passwd and added "/nologin" at the end of each line except root and his own. This was what was preventing people from logging in.

Why do that?




More in Tux Machines

Lenovo G50 & CentOS 7.2 MATE - Fairly solid

Is there a perfect track record for any which distro? No. Do any two desktop environments ever behave the same? No. Is there anything really good and cool about the MATE offering? Yes, definitely. It's not the finest, but it's definitely quite all right. You do get very decent hardware support, adequate battery life and good performance, smartphone and media support is top notch, and your applications will all run happily. On the other hand, you will struggle with Samba and Bluetooth, and there are some odd issues here and there. I think the Gnome and Xfce offerings are better, but MATE is not to be dissed as a useless relic. Far from it, this is definitely an option you ought to consider if you're into less-than-mainstream desktops, and you happen to like CentOS. To sum it all up, another goodie in the growing arsenal of CentOS fun facts. Enjoy. Read more

digiKam 5.2.0 is published...

After a second release 5.1.0 published one month ago, the digiKam team is proud to announce the new release 5.2.0 of digiKam Software Collection. This version introduces a new bugs triage and some fixes following new feedback from end-users. This release introduce also a new red eyes tool which automatize the red-eyes effect reduction process. Faces detection is processed on whole image and a new algorithm written by a Google Summer of Code 2016 student named Omar Amin is dedicated to recognize shapes and try to found eyes with direct flash reflection on retina. Read more

Games for GNU/Linux

Linux Graphics