1

My sites are hosted in a shared server at Hostgator.

Server details:

uname -a
Linux xxxx.hostgator.com x.xx.x.x86_64 #1 SMP Fri May 1 18:21:30 CDT 2015 x86_64 x86_64 x86_64 GNU/Linux

I was curious to see who is logged into the system and the output I am getting is:

$ who

me        pts/1        Nov  2 14:11 (x.x.x.x) <= That's me
littlebox pts/0        Nov  2 16:54 (186.59.101.53) <= Who is this?

$ w littlebox

18:29:25 up 48 days, 11:46,  2 users,  load average: 0.02, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
littlebo pts/0    186.59.101.53     16:54    0.00s  0.00s   ?    -

I have checked and am not seeing any such user by that name. Hence, there are no bash history files to see the activities (if any) performed. Hosting company says they aren't logged in.

I also checked the user logins in the recent past using last and am seeing this user 'littlebox' logged in twice today and once 2 days back.

Following are some entries which seems suspicious. My user/root entries have been trimmed off.

$ last

littlebo pts/0        186.59.101.53    Mon Nov  2 16:54 - 18:29  (01:35)    
littlebo pts/5        186.39.184.11    Mon Nov  2 08:58 - 09:02  (00:04)    
littlebo pts/4        190.113.162.226  Mon Nov  2 08:38 - 09:15  (00:36)    
gvr      pts/0        c-73-24-139-94.h Sun Nov  1 22:31 - 16:07  (17:36)    
gvr      pts/0        c-73-24-139-94.h Sun Nov  1 00:44 - 14:05  (14:21)    
gvr      pts/0        c-73-24-139-94.h Fri Oct 30 22:25 - 12:16  (13:50)    
inov2    pts/0        99-45-228-199.li Fri Oct 30 21:17 - 21:27  (00:10)    
littlebo pts/0        186.59.101.53    Fri Oct 30 16:30 - 16:47  (00:17)    
littlebo pts/0        186.59.40.135    Fri Oct 30 14:40 - 15:27  (00:46)    
ittlebo pts/1        186.59.55.133    Tue Oct 27 17:37 - 23:05  (05:28)    
littlebo pts/0        186.59.55.133    Tue Oct 27 17:04 - 18:38  (01:33)    
littlebo pts/0        186.59.55.133    Tue Oct 27 15:35 - 16:53  (01:17)    
jarmad   pts/0        115.178.250.160  Mon Oct 26 19:31 - 20:09  (00:38)    
littlebo pts/0        186.59.108.234   Mon Oct 26 14:45 - 19:00  (04:15)    
adzcer   pts/1        124.104.204.134  Sat Oct 24 23:18 - 23:43  (00:24)    
gvr      pts/0        c-73-24-139-94.h Sat Oct 24 11:41 - 11:43  (00:01)    
littlebo pts/1        186.59.108.234   Fri Oct 23 18:14 - 18:44  (00:30)    
littlebo pts/0        186.59.108.234   Fri Oct 23 17:33 - 19:52  (02:18)    
littlebo pts/1        186.59.108.234   Fri Oct 23 15:51 - 16:03  (00:11)    
littlebo pts/0        186.59.108.234   Fri Oct 23 15:31 - 15:52  (00:20)    
littlebo pts/0        186.59.0.201     Fri Oct 23 15:19 - 15:25  (00:05)    
gvr      pts/0        c-73-24-139-94.h Fri Oct 23 05:55 - 10:00  (04:04)    
littlebo pts/0        186.59.0.201     Thu Oct 22 15:11 - 17:35  (02:24)    
gvr      pts/0        c-73-24-139-94.h Thu Oct 22 00:33 - 10:23  (09:50)    
littlebo pts/0        186.59.121.19    Wed Oct 21 13:17 - 16:35  (03:18)    
ramnath  pts/0        117.194.37.189   Wed Oct 21 07:55 - 09:28  (01:32)    
littlebo pts/0        186.59.121.19    Tue Oct 20 23:40 - 23:45  (00:05)    
littlebo pts/0        186.59.121.19    Tue Oct 20 23:33 - 23:35  (00:02)    
jarmad   pts/0        115.178.236.121  Tue Oct 20 20:20 - 21:17  (00:57)    
littlebo pts/0        186.59.121.19    Tue Oct 20 19:10 - 19:16  (00:06)    
littlebo pts/0        186.59.121.19    Tue Oct 20 00:26 - 00:28  (00:01)    
littlebo pts/0        186.59.121.19    Mon Oct 19 20:34 - 20:40  (00:06)    
mcclxvii pts/4        69.80.105.74     Sun Oct 18 13:41 - 13:48  (00:07) 

What to do? Pls help!

  • 2
    WHat hosting company? What machine is this? What operating system? Since you mention a hosting company, I assume this is a remote server. Ok, what is it hosting? What is it running? How did you check for the existence of the user? Please edit your question and give us some more information. – terdon Nov 3 '15 at 0:50
  • Ok terdon, I've done that. Pls check. – Ramnath Nov 3 '15 at 1:15
  • Ok I have forced the user to logout but I am still curious to know how come this unknown user logged in and what he did after logging in? – Ramnath Nov 3 '15 at 1:33
  • 2
    according to whois, 186.59.101.53 is in Buenos Aires. How they got in is anyone's guess - you didn't provide any information that could be used to find out (and as you haven't fixed the security hole, there's nothing stopping them from logging in again). What they did while logged in might be viewable with less ~littlebox/.bash_history. – cas Nov 3 '15 at 3:27
  • 2
    security.stackexchange.com – mchid Nov 3 '15 at 4:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.