Help check atack

salimka · 10-20-2011, 02:07 AM

Hi,

By issuing a command on my redhat server this morning witch is :

more /var/spool/mail/root | grep root

assword

i've got the following result :

DUP root

assword:12.30.179.28
DUP root

assword:12.30.179.28
....

Thus, i wonder if it's an attack, and if yes, how can check if the attack has succeeded or not ?

Thanks

unSpawn · 10-20-2011, 05:13 AM

The only times I see those lines is when SSH scanners are used, often output will be a plain text file named "vuln.txt". The fact that it shows up in root mail may or may not be telling: best read and at on the information in the CERT Intruder Detection Checklist, scan the machine for foreign processes and binaries and your logs for anomalies (use Logwatch?).

lqman · 11-02-2011, 03:06 AM

Examine your system & service log files.

In my debian box, I always check my systemlog file at :
/var/log/syslogs and /var/log/messages

and service log file, e.g for SSH service :
/var/log/auth.log

and find something wrong there.

U must understand that Log file is very2 important file to examine.