topic Re: Hide myself from root. in Operating System - HP-UX

Hide myself from root.

Chua Wen Ching — Sun, 13 Oct 2002 10:10:37 GMT

In my org system, when i (a normal user) w or finger, i saw no one in the list. But when i use the command top, i can see other user's login id. Is that a background process using nohup? Is it possible to make myself hidden / invisible when the root enter w or finger in HP-UX 10.20. I had found some c scripts to make myself invisible but it cannot works in HP-UX 10.20. I want to make myself hidden without running as a root.

Re: Hide myself from root.

harry d brown jr — Sun, 13 Oct 2002 11:55:20 GMT

I'm sorry, but I DON'T think it's APPROPRIATE to discuss HOW TO HACK in this forum!

live free or die
harry

Re: Hide myself from root.

Chua Wen Ching — Sun, 13 Oct 2002 15:53:56 GMT

I not really want to learn how to hack? I just want to know as a system admin, is there such thing (make normal user account invisible using bourne shell scripting) so that i can beware in future. How about some references? Does bourne shell had the capabilities or not? Anyway i would like to apologize for asking this question here.

Re: Hide myself from root.

Christian Gebhardt — Mon, 14 Oct 2002 04:59:57 GMT

Without details:

It is possible to hide something, "samhain" is a program using such mechanism.If it not necessary for security for system administration task it causes problems if more administrators work on the machines and it is not well documented.
Chris

Re: Hide myself from root.

Paula J Frazer-Campbell — Mon, 14 Oct 2002 10:20:39 GMT

Hi

Seeing a process in the process list owned by a user does not mean that that user is logged in.

A nohup & will show this also any running process designed to loop or call other processes will also show in the ps list.

Yes it is possible to hide from roots use of who as this info is stored in wtmp and can be modified.

Ownerships can be changed so that even in the ps list a user will not be seen.

Security is about closing down loopholes, giving your users ???Just enough??? permission to carry out their job and knowing your systems.

This doc will help on security:-

http://people.hp.se/stevesk/bastion11.html

Paula

Re: Hide myself from root.

Chua Wen Ching — Mon, 14 Oct 2002 10:29:47 GMT

Is there any sample bourne shell script or c script that allow me to hide myself (related to wtmp)? Is wtmp owned by root. If i am a normal user how am i suppose to modify or write into wtmp? I am kind of confuse. But anyway thanks for the guide to protect hp-ux.

Re: Hide myself from root.

Paula J Frazer-Campbell — Mon, 14 Oct 2002 10:51:49 GMT

Sorry

I cannot post this sort of info on the forum as it is dangerous.

You will find that a good sysadmin has lots of links to hacker sites and watches what is going on and notes system weak areas.

To start you off try here:-

http://www.astalavista.com/archive/hacking/

Paula

Re: Hide myself from root.

Chua Wen Ching — Mon, 14 Oct 2002 11:11:13 GMT

I think it is kind of sensitive to talk this issue here. Anyway thanks for your advise. I will bear that in mind.