Linux

Ask something
Discussion Locked

Problem with new users appearing.

0 helpful
5 replies

by vasjatka

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Sometimes new users are appering on my FreeBSD 2.2.5. They are installing some EggDroppers or DarkBots. I restricted access by /etc/login.access but they still able to appear. I don't like it ;o) What can I do?

5 replies

by rob

Try closing telnet and ftp access or change the port #.If you just change the port numbers this should keep most people out.If not you may have to close them down. Also look at the file permissions of you /etc/passwd file (shadow too if you use it) they should be read only

by vasjatka

1. FTP and telnet are closed from outside network by default.
Anyway such access is logged in /var/log/wtmp but there are only unsuccessful (zero-time) logins and AFTER user appearanse.
2.
$ ls -l /etc/*passw*
-rw------- 1 root wheel1970 Nov 27 12:25 /etc/master.passwd
-rw-r--r-- 1 root wheel 1367 Nov 27 12:25 /etc/passwd

by insatiable

It sounds like you've been compromised!

I'm a security professional, but I don't know FreeBSD at all, other than it's unix.
I highly advise you to go to www.cert.org for more information, and possibly report the intrusion when you have enough information.
This link has several documents that will help you, including how to detect intrusion.

http://www.cert.org/security-improvement/

Good luck -- I'm interested in finding out what happens. Email me! :-)

This discussion is closed to new replies.