2

I have a ubuntu box and found this "2" file in /var/run/systemd/sessions. First thought was that I have been hacked because I don't recognize this IP address and have not explicitly configured this file as far as I know.

57.36.154.104.bc.googleusercontent.com

Note, my non-root user is rsmit.

Any idea what this "2" file is for?

root@willow1:/var/run/systemd/sessions# uname -a
Linux willow1 3.13.0-71-generic #114-Ubuntu SMP Tue Dec 1 02:34:22 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

root@willow1:/var/run/systemd/sessions# ls -altr
total 4
drwxr-xr-x 5 root root 100 Feb 25 17:04 ..
prw------- 1 root root   0 Feb 27 19:42 2.ref
-rw-r--r-- 1 root root 277 Feb 27 19:42 2
drwxr-xr-x 2 root root  80 Feb 27 19:42 .

root@willow1:/var/run/systemd/sessions# cat 2
# This is private data. Do not parse.
UID=1000
USER=rsmit
ACTIVE=1
STATE=active
REMOTE=1
KILL_PROCESSES=0
TYPE=tty
CLASS=user
CGROUP=/user/1000.user/2.session
FIFO=/run/systemd/sessions/2.ref
REMOTE_HOST=57.36.154.104.bc.googleusercontent.com
SERVICE=sshd
LEADER=2107
AUDIT=2
root@willow1:/var/run/systemd/sessions# 
3

You can also access this information via loginctl show-session 2 and list all active sessions via loginctl list-sessions.

What the record means is that there's an active SSH connection coming from 57.36.154.104.bc.googleusercontent.com to a user rsmit.

So unless you know someone from that domain should be logged in as rsmit I'd suggest seeking out appropriate incident response immediately.

(Disconnect the machine from network, check logs, check running processes etc.)

https://security.stackexchange.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.