Dotaz: Interpretace logu - new session of user nobody - server hack?

[petr.nosek]

Geekové,

prosím o radu v rámci interpretace log souboru. Zaznamenal jsem dnes ráno jsem zaznamenal v auth.log:

Aug  4 03:25:01 zeus CRON[24301]: pam_unix(cron:session): session closed for user root
Aug  4 03:25:02 zeus CRON[24302]: pam_unix(cron:session): session closed for user www-data
Aug  4 03:29:16 zeus su[27091]: Successful su for nobody by root
Aug  4 03:29:16 zeus su[27091]: + ??? root:nobody
Aug  4 03:29:16 zeus su[27091]: pam_unix(su:session): session opened for user nobody by (uid=0)
Aug  4 03:29:16 zeus systemd-logind[347]: New session 34 of user nobody.
Aug  4 03:29:16 zeus systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Aug  4 03:29:16 zeus su[27091]: pam_unix(su:session): session closed for user nobody
Aug  4 03:29:16 zeus systemd-logind[347]: Removed session 34.
Aug  4 03:29:16 zeus systemd: pam_unix(systemd-user:session): session closed for user nobody
Aug  4 03:29:16 zeus su[27096]: Successful su for nobody by root
Aug  4 03:29:16 zeus su[27096]: + ??? root:nobody
Aug  4 03:29:16 zeus su[27096]: pam_unix(su:session): session opened for user nobody by (uid=0)
Aug  4 03:29:16 zeus systemd-logind[347]: New session 34 of user nobody.
Aug  4 03:29:16 zeus systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Aug  4 03:29:16 zeus su[27096]: pam_unix(su:session): session closed for user nobody
Aug  4 03:29:16 zeus systemd-logind[347]: Removed session 34.
Aug  4 03:29:16 zeus su[27111]: Successful su for nobody by root
Aug  4 03:29:16 zeus systemd: pam_unix(systemd-user:session): session closed for user nobody
Aug  4 03:29:16 zeus su[27111]: + ??? root:nobody
Aug  4 03:29:16 zeus su[27111]: pam_unix(su:session): session opened for user nobody by (uid=0)
Aug  4 03:29:16 zeus systemd-logind[347]: New session 34 of user nobody.
Aug  4 03:29:16 zeus systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Aug  4 03:29:39 zeus su[27111]: pam_unix(su:session): session closed for user nobody
Aug  4 03:29:39 zeus systemd-logind[347]: Removed session 34.
Aug  4 03:29:39 zeus systemd: pam_unix(systemd-user:session): session closed for user nobody
Aug  4 03:29:51 zeus sshd[27342]: Connection closed by 127.0.0.1 port 44846 [preauth]
Aug  4 03:30:01 zeus CRON[27349]: pam_unix(cron:session): session opened for user www-data by (uid=0)
Aug  4 03:30:01 zeus CRON[27348]: pam_unix(cron:session): session closed for user root
Aug  4 03:30:02 zeus CRON[27349]: pam_unix(cron:session): session closed for user www-data
Aug  4 03:30:36 zeus CRON[24299]: pam_unix(cron:session): session closed for user root
Aug  4 03:34:51 zeus sshd[27950]: Connection closed by 127.0.0.1 port 44888 [preauth]

Jde o čas 03:29. Nějak se mi nezdá aktivita s uživatelem nobody. Podobné výpisy vidím, když se přihlásím skrze SSH ke svému serveru jako validní uživatel. Tohle mě ale zaskočilo.

Osobně si nemyslím, že došlo k průniku na server, nicméně snažím se pochopit, jak si log interpretovat.

Prosím o názor. Děkuji.

---

---

Odpovědi

[SpaceExplo]

Session pro uzivatele "nobody" byla otevrena rootem.

Mozna neco cronu nebo se muzes inspirovat zde https://www.howtoforge.com/community/threads/user-nobody-in-my-logs.20144/

[1john2]

díky, šel jsem do

/etc/crontab

a podle času jsem přišel na to, že to odpovídá některému z procesů, které jsou spouštěny v

/etc/cron.daily

postupně jsem si je spouštěl a zjistil jsem, který to dělá. Byl to locate, který jsem nedávno instaloval kvůli jednomu skriptu.

Díky za tip. Všechno je ok :)

[SpaceExplo]

Za malo