Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one entry from the outside. There's no bash history nor anything easily noticeable. What should I check to know my computer is not compromised?

share|improve this question
    
If root is compromised, they can tamper with the logs. –  jordanm Jan 15 '13 at 2:38
    
I know, they actually gained root access. But why should they leave their trace in auth.log? –  Tomas Jan 15 '13 at 2:44
1  
I would say stat important files in your server.don't forget to read this and this –  harish.venkat Jan 15 '13 at 3:38
add comment

1 Answer

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.