topic Re: Strange log entry in Operating System - HP-UX

Strange log entry

Scott E Smith — Wed, 19 Jun 2002 18:38:01 GMT

I got the following message in my syslog early yesterday .....
Jun 18 00:52:46 hostname root: Hey, look I'm logged on as root at the console. Not good...
Jun 18 00:52:47 hostname root:
Jun 18 00:52:53 hostname root: d

Does anyone have any ideas on what this might be?

Re: Strange log entry

John Poff — Wed, 19 Jun 2002 18:45:05 GMT

Hello,

It looks like someone logged in as root and used the 'logger' command to leave you a message in syslog. Not good. If you don't know who did it you'd better start checking to see if your system has been compromised.

You can write messages to syslog.log via the logger command, and it records your hostname and your user id. I hope everything is ok for you.

JP

Re: Strange log entry

PIYUSH D. PATEL — Wed, 19 Jun 2002 18:46:21 GMT

Hi,

This certainly means that somebody has logged in into your system with root login. Have you given the root access to anybody.

Then he has used the logger command to pass this message to your syslog.log file

Piyush

Re: Strange log entry

Jeff Schussele — Wed, 19 Jun 2002 18:49:20 GMT

Hi Scott,

I'd suspect that someone left the console logged in as root & someone came along & ran the logger command which allows root to make syslog entries. The "d" was *probably* a failed ctrl-d that got logged.....

The other scenario is that someone has the root PW & su'd up & made those entries - again using logger.

Note these didn't necessarily have to be done from the console....syslog doesn't log tty info.

In either case, you need to lock this box down some more. Looks like that was the *purpose* of this exercise.

Rgds,
Jeff

Re: Strange log entry

Victor_5 — Wed, 19 Jun 2002 18:49:38 GMT

I never see that before in syslog, obviously it is not wrote by system, the first thing I can do, if I were you, is change password right away, and try to find the root cause if you can.

Re: Strange log entry

Thomas D. Harrison — Wed, 19 Jun 2002 19:25:18 GMT

A suggestion or two.

last -R root | more ==> to see where root was logged in from during this time period.

view /var/adm/sulog ==> to see who might have su'd to root.

Of course, if you find that the id HACKER su'd to root you could try last -R HACKER | more

Good luck!

Thom