19

I'm on Ubuntu 15.04 and today I've been reading an article about Linux security from this link.

Everything went good until the part of UID 0 Account

Only root should have the UID 0. Another account with that UID is often synonymous to backdoor.

When running the command they gave me, I found out there were another root account. Just after that I disabled the account as the article do but I'm sort of afraid of this account, I can find him on /etc/passwd

rootk:x:0:500::/:/bin/false

And in /etc/shadow

rootk:!$6$loVamV9N$TorjQ2i4UATqZs0WUneMGRCDFGgrRA8OoJqoO3CCLzbeQm5eLx.VaJHeVXUgAV7E5hgvDTM4BAe7XonW6xmup1:16795:0:99999:7::1:

I tried to delete this account using userdel rootk but got this error ;

userdel: user rootk is currently used by process 1

The process 1 is systemd. Could anyone give me some advice please ? Should I userdel -f ? Is this account a normal root account ?

Improve this question
11
  • 5
    I strongly suspect this error is simply because they have the same UID (0). I just did a test by creating a second user with an existing UID and it was reported as being the first one in /etc/passwd. I also doubt that removing that account could have any impact on the machine since files and processes refer to the UID and not the username. It would be advisable (although most likely not required) to have a recovery disk handy but I would remove it and restart the machine without any worry.
    – Julie Pelletier
    Commented Aug 17, 2016 at 6:00
  • 2
    Removed rootk from /etc/passwd & /etc/shadow ; rebooted and everything is good now, root is being the only one shown as root user Thank you for your help !
    – Lulzsec
    Commented Aug 17, 2016 at 6:53
  • 3
    Either case, try to run some root-kit detector, as you could probably have been infected by one. rootk is too suspicious name, and having a non-disabled password is worse a symptom of having been defeated by a trojan horse. By the way, don't remove the entry, just insert some letter at the password field to disable it, as it will give you clues to know how did you get infected.
    – Luis Colorado
    Commented Aug 17, 2016 at 8:08
  • 1
    @DarkHeart, Nope, I'm afraid not... but having a rootk account with a supposed valid password (not disabled) is a strong symptom of some network exploit or misuse of the root account by the local user. As we use to say: "Do trust the Holy Virgin, and don't run...". By the way, do you think I'm a sixteen years old guy with no experience in unix/linux? :(
    – Luis Colorado
    Commented Aug 17, 2016 at 8:30
  • 2
    May want to check if /bin/false is the genuine file by running sudo dpkg -V coreutils. If it's been altered, please consider reinstalling everything. Ubuntu 15.04 has been EOL for 6 months, so any existing and future security holes aren't going to be fixed, so you may want to install a newer version such as 16.04.
    – Mark Plotnick
    Commented Aug 17, 2016 at 14:54

2 Answers 2

Reset to default
27

Processes and files are actually owned by user ID numbers, not user names. rootk and root have the same UID, so everything owned by one is also owned by the other. Based on your description, it sounds like userdel saw every root process (UID 0) as belonging rootk user.

According to this man page, userdel has an option -f to force removal of the account even if it has active processes. And userdel would probably just delete rootk's passwd entry and home directory, without affecting the actual root account.

To be safer, I might be inclined to hand-edit the password file to remove the entry for rootk, then hand-remove rootk's home directory. You may have a command on your system named vipw, which lets you safely edit /etc/passwd in a text editor.

Improve this answer
8
  • Thank you answering! I feel king of relieved, I thought it was some badass backdoor ! I did as you said, I removed the entry for rootk in /etc/passwd. But there were no rootk's home directory
    – Lulzsec
    Commented Aug 17, 2016 at 6:16
  • 26
    @Lulzsec: This in no way tells us if the rootk account was created as a backdoor. It just means that it can be removed easily.
    – Julie Pelletier
    Commented Aug 17, 2016 at 6:20
  • 2
    I think you have not completely solved the problem. Check my comments on your question, please.
    – Luis Colorado
    Commented Aug 17, 2016 at 8:11
  • 6
    Be careful not to run userdel -r, as apparently rootk's home directory is /
    – Jeff Schaller ♦
    Commented Aug 17, 2016 at 15:09
  • @JeffSchaller But if you do, you have also solved the problem, in a way. A malicious user couldn't see any files!
    – kirkpatt
    Commented Aug 17, 2016 at 16:04
23

That indeed looks like a backdoor.

I'd consider the system compromised and nuke it from orbit, even if it is possible to remove the user you have no idea what interesting surprises were left on the machine (e.g. a keylogger to get users' passwords for various websites).

Improve this answer
12
  • 4
    put it in the microwave and buy a new one.
    – Aaron McMillin
    Commented Aug 17, 2016 at 12:56
  • 2
    What makes that look like a backdoor? Does it match any known profiles, rootkits, etc.?
    – Freiheit
    Commented Aug 17, 2016 at 14:34
  • 5
    @Freiheit Well, an additional user with root permissions is pretty much the definition of a rootkit / backdoor. Once somebody was logged in as that user, they could pretty much compromise anything on the system. Even if the account was created for some innocent purpose (amd I have no idea what that would be), someone else could have discovered it and used it maliciously (read up on the Sony DRM that rootkitted Windows for example).
    – IMSoP
    Commented Aug 17, 2016 at 14:51
  • 1
    @kasperd: The password's not disabled, it's in /etc/shadow. Setting the shell to /bin/false (if that hasn't been tampered with) may disable interactive login, but won't prevent the account from being used in other ways. For example, sudo -s will look at the SHELL environment variable, not /etc/passwd, to determine what shell to run.
    – Ben Voigt
    Commented Aug 17, 2016 at 19:26
  • 1
    @kasperd: Ah, ok. Might it be a way to get tasks executed periodically as root from a hidden crontab (although the choice of / as home directory seems inconsistent with that)?
    – Ben Voigt
    Commented Aug 17, 2016 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .