Full Disclosure mailing list archives
Re: sshd logins without a source
From: Guillaume Friloux <guillaume.friloux () asp64 com>
Date: Fri, 23 Sep 2011 11:10:01 +0200
Hello, http://packetstormsecurity.org/UNIX/penetration/log-wipers/indexdate.html On 23/09/2011 05:45, BH wrote:
Hi, I am taking a look at a few different servers that have been rooted at around the same time. At the time of the compromise I can see in each servers sshd logs an entry like the following: Sep 22 12:57:14 test-vm sshd[25002]: pam_unix(sshd:session): session opened for user root by (uid=0) Sep 22 12:57:32 test-vm sshd[25002]: pam_unix(sshd:session): session closed for user root Each of the servers has the same sort of entry in the log that match with the time that extra processes were being executed. Having a look at all other available logs (that were logged remotely) I can't see anything else that relates to the same event. To me it seems odd that there is no IP address corresponding with the login, I can't seem to reproduce that on my test servers. I also can't see the authentication method used as that isn't logged. Has anyone seen this before and know how this is done? Thanks _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Attachment:
guillaume_friloux.vcf
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- sshd logins without a source BH (Sep 23)
- Re: sshd logins without a source Guillaume Friloux (Sep 23)
- Re: sshd logins without a source paul . szabo (Sep 23)
- Re: sshd logins without a source Laurelai (Sep 23)
- Re: sshd logins without a source paul . szabo (Sep 23)
- Re: sshd logins without a source BH (Sep 23)
- Re: sshd logins without a source Laurelai (Sep 23)
- Re: sshd logins without a source paul . szabo (Sep 23)
- Re: sshd logins without a source Jason A. Donenfeld (Sep 26)
- Re: sshd logins without a source Laurelai (Sep 23)
- Re: sshd logins without a source james (Sep 23)