Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
10-01-2006, 08:43 PM
|
#1
|
LQ Newbie
Registered: Sep 2006
Location: USA
Distribution: CentOS 4.5
Posts: 27
Rep:
|
/tmp folder
I'm seeing many folders beginning with "ssh" is that normal? Also, noticed a psy folder there  it looks like psybnc is installed. I have removed that folder and the psy.gz file. 
|
|
|
10-02-2006, 03:11 AM
|
#2
|
Senior Member
Registered: Jun 2006
Location: Hyderabad, India
Distribution: Fedora
Posts: 1,191
Rep:
|
this could mean serious trouble. bnc must be installed in other places also. (my guess)
check your netstat for any new ports that are open. check ps for suspicious processes. use chkrootkit to see if it detects anything. you would want to see your logs as to where the intruder came in from.
This could probably be some thing like a remote file inclusion in phpbb or something, so check your apache logs.
search for world writeable directories too and see if there is anything installed on them.
|
|
|
10-02-2006, 05:56 AM
|
#3
|
Member
Registered: Dec 2004
Location: Maidstone, Kent, England
Distribution: Ubuntu
Posts: 100
Rep:
|
oh yeh, I have those folders too, always have (ssh folders). I assume they are harmless.
|
|
|
10-04-2006, 06:06 AM
|
#4
|
LQ Newbie
Registered: Aug 2006
Posts: 25
Rep:
|
If you are using ssh then temp folders may be normal, I don't get them with openssh though. Either way they won't be needed after a reboot, so removing the lot and rebooting should work fine (in theory, you can dump the whole of /tmp, but I've found X was a bit picky about that). If you think you might have a security problem then you need to get busy with netstat as w3bd3vil describes.
|
|
|
10-04-2006, 08:21 AM
|
#5
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
If you have a psybnc sourcecode in tmp and you didn't put it there, then that is very bad sign. First who owned the file(s)? I would also recommend that you don't delete any more files or directories until you have a better idea of what is going on. Do follow webdevil's advice and look carefully through your apache logs, especially for URLs that have shell commands like wget, cd, etc or contain psy.gz. Don't ignore the issue and delude yourself into thinking everything is ok until you can be definitely sure of that.
The following will give you a good start:
http://www.cert.org/tech_tips/intrud...checklist.html
http://www.cert.org/tech_tips/root_compromise.html
If you have any questions about stuff or don't know what to look for, then make sure to ask.
|
|
|
10-04-2006, 08:05 PM
|
#6
|
Member
Registered: Sep 2004
Distribution: Debian Testing / Unstable
Posts: 180
Rep:
|
/tmp/ssh-XXXXXXXX file(s) may be ssh-agent files
If ssh-agent is started when a remote client logs in, a subdirectory of this type of name will be created and will contain one symbolic link named agent.PPPP where "PPPP" is
the PID of the agent.
One of these is created automatically when a local GNOME X session is started (probably also for KDE and other GUIs) so that an X terminal started in the GUI doesn't need to prompt for the password.
|
|
|
10-04-2006, 08:15 PM
|
#7
|
Member
Registered: Sep 2004
Distribution: Debian Testing / Unstable
Posts: 180
Rep:
|
Check that, the PID is the PID of the process that invoked the agent. On my machine I currently have one such directory and the file is actually
a system file of some sort, not a symbolic link (I think).
|
|
|
10-04-2006, 08:15 PM
|
#8
|
Member
Registered: Sep 2004
Distribution: Debian Testing / Unstable
Posts: 180
Rep:
|
...and the PID is that of "gnome-session". So noted regarding edit. :-)
Last edited by sixerjman; 10-26-2006 at 10:42 AM.
|
|
|
10-21-2006, 05:23 AM
|
#9
|
Member
Registered: Dec 2004
Location: Maidstone, Kent, England
Distribution: Ubuntu
Posts: 100
Rep:
|
very smart sixerjman I had no idea gnome did that, also for the future you can edit your post to add stuff to it rather than posting two more posts. just saying.
|
|
|
10-24-2006, 01:10 AM
|
#10
|
Senior Member
Registered: Jul 2003
Location: NY
Distribution: Slackware, Termux
Posts: 1,067
|
"Pysbnc" (sort of a proxy for IRC clients, or "bouncer" as they call them) is usually the first thing added by script kiddies after a system break-in. If you didn't put it there, you're definately hacked. Worse, many times pysbnc (and other tools from these types) is infected with linux virus RST (judging from the samples I've collected over the years).
It's looking like re-build/re-install time...
|
|
|
All times are GMT -5. The time now is 11:47 AM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|