4

I rented this cloud server, and it is kind of attacked recently. I can see a suspicious user logged in via tty.

leetom@S152:~$ last -x ayn1
ayn1     tty1                          Wed Oct 28 18:59 - 19:01  (00:02)
ayn1     tty1                          Wed Oct 28 18:55 - 18:59  (00:03)

As far as I know, if my server is cracked, the user could only login via pts (ssh or something else), and the ip address should be recorded. So I think the service provider's host machine might be cracked and this suspicious user logged in via the host. Is that possible? (Of course they don't admit it.)

By the way, I can see the root@(none):/# useradd -o -u 0 -g 0 -M -d /root -s /bin/bash ayn1 command from their web console, but I don't know how they implement the web console.

update

This happened again, and I found this log:

Nov  1 17:31:36 S152 login[21780]: pam_unix(login:auth): check pass; user unknown
Nov  1 17:31:36 S152 login[21780]: pam_unix(login:auth): authentication failure; logname=ayn1 uid=0 euid=0 tty=/dev/tty1 ruser= rhost=
Nov  1 17:31:39 S152 login[21780]: FAILED LOGIN (1) on '/dev/tty1' FOR 'UNKNOWN', Authentication failure
Nov  1 17:33:21 S152 sshd[804]: Received signal 15; terminating.
Nov  1 17:33:21 S152 sshd[1039]: Server listening on 0.0.0.0 port 22.
Nov  1 17:33:21 S152 sshd[1039]: Server listening on :: port 22.
Nov  1 17:33:45 S152 login[1563]: pam_unix(login:auth): check pass; user unknown
Nov  1 17:33:45 S152 login[1563]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost=
Nov  1 17:33:49 S152 login[1563]: FAILED LOGIN (1) on '/dev/tty1' FOR 'UNKNOWN', Authentication failure
Nov  1 17:34:00 S152 login[1563]: pam_unix(login:session): session opened for user yan1 by LOGIN(uid=0)
Nov  1 17:34:00 S152 login[2054]: ROOT LOGIN  on '/dev/tty1'
Nov  1 17:34:53 S152 login[1563]: pam_unix(login:session): session closed for user yan1
  • 1
    If there's no other evidence to the contrary, it looks like your suspicion is correct: either the service provider did this themselves or their host (or possibly just their web console) has been cracked. – cas Oct 29 '15 at 5:38
  • if it's just their web console, maybe you chose a crappy easily-cracked root password for your VM or for your web-console account. – cas Oct 29 '15 at 5:40
  • @cas The root password is quite complex (16-digit long random string), and there is no suspicious login record to the web console. – leetom Oct 29 '15 at 6:24
  • 2
    in that case maybe you should start looking for another cloud service provider. – cas Oct 29 '15 at 6:26
  • They told me the users might be created by script and logged in with a different way. Is that possible? – leetom Oct 29 '15 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.