I seem to be running a mailserver on opensuse 10.3 and I didn't set it up
 

I think I have a security issue. I'll be quite happy to find out I'm dumb and paranoid and take off my tinfoil hat.

I've been running various distros of linux for the last 3 years with some previous intermittent use back to around Suse 7.2. I'm not any sort of linux guru and I'm not as familiar with linux security as I am with Windows security. I'm running Opensuse 10.3 64 bit, KDE default installation and all fully updated. This is my first 64 bit installation. I've run 32 bit up until now.

For the last two or three days my LCD monitor has been behaving oddly - slight lack of focus and then OK. I assumed it was the monitor and swapped it with my old trusty CRT and ran that for a day. Still the odd behaviour. On the old box both the monitors work fine.

I ran top as a user and there was nothing interesting I could see. I ran it as user though, not as root. The machine has root, me and smallchild as users. Is that setup users or current users? So I ran netstat -an and I got screens full of CONNECTED and LISTENING.Probably 2 or 3 more screenfuls than usual and several paths I didn't recognise. I googled heaps of them and discounted several as legitimate but there are several directories that don't appear to be default. They are all listed in the 12000 port range. Why do I have entries for /private/xxxxxxx but no /private directory? Why am I running ssh when I don't have it set up and I don't need it? I seem to be running a mailserver.


So I checked the firewall status and it was OFF. I re-enabled the firewall. But it was not me that disabled it. It has always been enabled since installation as far as I know. I only need email and web access and no need for anything more exiting than the odd upload to my website. I have crossover for my two Windows "must haves" Everything else is standard opensuse and from the repos except for a couple of games for under 5s.

I'm trying to decide whether it's a reinstall job or if I should try and track it down and learn a bit more. I'd like to wait for the next release if possible.

Where would I start? I have kept the logs I did but I ran them as a user, not as root. I wasn't going to log in as root while I thought something was wrong.

To disable the firewall you need root privilege
In you,re dsl modem is there a build in firewall ?
If so do you protect it with Administrator and password ?
If you do so with different passwords than somebody meet two firewall
May be it is worth while to run a virus scanner.

all the best

Instead of running a virus scanner I'd suggest booting a Live CD and using the Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html checklist to look for clues. Just before you reboot into the CD, log in as root and run these commands: '( /bin/ps -axfwww -eo ppid,pid,uid,args 2>&1; /bin/netstat -n 2>&1; /usr/sbin/lsof -w -n 2>&1; /usr/bin/last 2>&1; /usr/bin/who --heading --dead -u --login --lookup --process --time --mesg --users 2>&1 ) | tee /tmp/tee.log' (maybe put that in a script to run). Also try running 'rpm -qVa' after you booted the CD.

Thanks for that unSpawn. That's exactly what I was after because I wasn't sure where to start. I'd know in Windows, but this is first chance I've had to look at a linux situation.

I usually use a Knoppix Live CD for fixing so I'll make sure all my data is backed up and see what I can learn before I nuke this one.

My router has NAT enabled and it doesn't have default log in passwords. There is no evidence that any other computer on my LAN has issues. Whatever this is, is limited to this machine and it looks like a trojan of some type to me. It seems very controlled. Viruses, on Windows anyway, tend to have scattergun effects and I'm not aware of too many Windows type viruses on linux machines. Trojans and rootkits are a bigger concern.

It can't do much if the machine is shutdown or not connected.

Not trying to influence perception but, unless you ran (outdated versions of) applications or services unrestricted and exposed to world, the chance of you catching a rootkit or trojan will be smaller than you winning the lottery (sorry).

I know that - I just do a lot Windows malware removal, so I've learnt to expect the worst :)

I do have some sort of a problem though and I'd like to at least know what it is.

This is the netstat -an result I'm concerned about.
gail@linux:~> netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 192.168.1.102:52313 202.6.74.96:80 ESTABLISHED
tcp 0 0 192.168.1.102:45256 202.6.74.96:80 ESTABLISHED
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 ::1:631 :::* LISTEN
tcp 0 0 ::1:25 :::* LISTEN
udp 0 0 0.0.0.0:32768 0.0.0.0:*
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 0.0.0.0:5353 0.0.0.0:*
udp 0 0 0.0.0.0:111 0.0.0.0:*
udp 0 0 0.0.0.0:631 0.0.0.0:*
Active UNIX domain sockets (servers and established)

I used bold on the entries I'm concerned about.
Next bit in next post

Rest of log
Within the limits of my knowledge and experience, the only thing I found of concern is that I have nx installed in my user profile. It was installed from the repos, but there are clear indications that it belongs to to gopc.net with their legitimate IP included. The logs show it has never been used. I have no idea how it got there. It's dated 1st May

I did run some of the commands suggested. Should I post those so someone can have a look.

You have SSH, mail, RPC, mDNS, BOOTP and IPP listening. If the machine was not firewalled to deny access from the 'net to those services that could be a Bad Thing if they allowed access to the system one way or another. That doesn't automagically mean your machine got subverted (and there are no outbound network connections that look suspicious) but proceding with further checks would be a Good Thing, even if only to get acquainted with a procedure.


These are "UNIX" domain sockets (AF_UNIX), not to be mistaken for network connections (AF_INET). They are basically named pipes through which processes "talk" to eachother. If you 'lsof -w -n | egrep "private/(relay|error|anvil)"', you can see the process name, process ID, username, socket type and location of the process. Knowing the process ID or PID means that for PID $PID, the executable is located at /proc/$PID. So 'readlink -f /proc/$PID/exe' shows you which binary is responsable. Why not simply look at the process name? Well, the name (argv[0]) can be changed easily. If you only see "httpd" you might think it's Apache, but finding it's "/tmp/.../apache" would be more than suspicious. In your case you'll find your sockets are part of that certain MTA that needs a gazillion binaries and processes to do what others do with just one or two.



Please do, but please use BB code tags. If it's too much lines you could make a compressed tarball out of it, upload to some free file hosting provider and post the URI here.