Solved

No directory! - Root permisions where changed to 0 now it is 755 - No evidence in last command of yesterday

Posted on 2011-02-17
3
511 Views
Last Modified: 2013-12-27
Hi experts.
I receive an alert yesterday night from our Oracle monitoring system of one of the two unreacheable nodes, (one has a more upgraded version of the monitoring agent).  In one of the nodes there is no evidence of the logging via last command - solaris Sparc 64 bit.
Can it be possible that one of this two things be possible?

1- Someone can enter and change root permissions in the Solaris node without a trace in the last command.

2- There is some sort of certification expiration or software expiration that will change the root permissions to 0 yesterday february 16 like some kind of "trial software" or some kind of "virus software".
0
Comment
Question by:LindaC
  • 2
3 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 500 total points
ID: 34915474
Hi,

1 - yes, that's possible if you have ssh installed. ssh remote command execution never uses login(), so there is no trace in wtmp (the file "last" relies on).
Of course one must be able to gain root authority to perform the actions you mentioned.
If the malicious person is in possession of root's password they could do:

ssh root@node 'chmod 755 ....' (if root login via ssh is permitted)
or
ssh user@node -c #su - -c chmod 755 ...'

2 - possible, of course, but I never heard of such phenomena before.

wmp
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 34915501
Sorry, the second "ssh" example should read:

ssh user@node -c 'su - -c chmod 755 ...'

ssh would log connections via syslog if configured.
You need an entry "auth.info /path/to/log' ("info" or higher) in /etc/syslog.conf or a catch-all entry "*.info /path/to/log".

wmp
0
 
LVL 8

Author Closing Comment

by:LindaC
ID: 34938300
Thank you.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap (http://www.tcpdump.org) Version 1.2 2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6 Prerequisite: 1.      GCC …
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

26 Experts available now in Live!

Get 1:1 Help Now