[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: weird process...




Some people run sshd out of the startup scripts.  I don't remmeber where.  I just remember in the days before I found openssh, having to add a line to a file somewhere to make sshd start.  Would that show as running as a child of init?  Isn't sftp part of the SSH stuff?  

Randy    


-----Original Message-----
From: Sean \The RIMBoy\ [mailto:sean@rimboy.com]
Sent: Thursday, March 06, 2003 12:53 PM
To: jerome
Cc: silug-discuss@silug.org
Subject: Re: weird process...


On Fri, 7 Mar 2003, jerome wrote:

> i was looking for my bandwidth eater.... and i did some minor investigation i 
> found out that in one of my box someone is doing an ftp to 
> ftp.geocities.com.. initial action was to look who's connected and after did 
> a pstree to look where the sftp respawn... luckily it didnt respawn in a user 
> login... it respawn from init...
> 
> can someone tell me where to look so it doesnt happen again.... furthermore 
> when i did the top:
> 
> #top
>   PID USER   PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME COMMAND
> 14791 userx  19      0   229M 229M  588        R        99.9   22.9    23425m 
> sftp
> 
> # pstree -ap
> 
>  init,1)
>    |
>    |
>    |-sftp,14791) ftp.geocities.com


um, let me get this straight.  You don't know who's doing the ftp to 
geocities?  And the fact that it's being respawned out of init is not 
good.  I'd venture to say you've been rooted and should probably install 
an airgap firewall ASAP.   There is no not making it happen again without 
taking it offline and figuring out how they got in.  The fact that they 
modified your inittab means they probably also have root.  You are really 
going to want to salvage what important data you can, wipe the HD and 
reinstall.  There is no remodeling after this mess IMO, without rebuilding 
the house.

Sean...

--
Believing I had supernatural powers, I slammed into a brick wall.
	--Paul Simon
_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
KG4NRC  http://www.rimboy.com  Your source for the crap you know you need.


-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.