How did they do this?

[Gordon Morrison_1]

Just because you have disabled (direct) root logins doesn't prevent someone from logging in, then using su to gain root permissions.

I would suspect an inside job, then start looking at the logs from other hosts from which they could have logged into this one from. (I presume you know approximately when this happened?)

They wiped their fingerprints from the house they burgled, but did they wipe their footprints from the path outside?

[Rick Garland]

Hi Gordon:

I did have the PAM setup to only allow root logins to members of the wheel group. If this was an inside job, then this would have been done by a wheel group member.

Even if I gave out the root passwd to the world, if you are not a member of the wheel group you can not access the root account unless you are sitting at the console in a secure data center.

As to looking for outside footprints, there is no other access from other systems. Exception, members of the wheel group have access to the system from their local desktops but firewalls prevent access from any other server within the data center. Access to the system was gained from the outside via VPN, else you hit the URL in your web browser.

[Paul Cross_1]

check all suid files, not just shells. suid vi is common. vi /etc/passwd is very simple...

[Don_89]

I would run nessus against the box to point out vulnerabilities. Also, setup syslog to log to a different server so if it happens again, you'll at least have an IP address to track down..


Also, someone posted that the passwords were possibly sniffed. This isn't true if your using SSH..

[Rick Garland]

Hi all:

Its been over a year since this incident. I have upgraded all packages. No further incidents have occurred.

Many thanks to all the ideas. I am keeping track of each and every one of these ideas as my baseline for setting up new systems.

I must close this thread now.

Again, thanks

[Rick Garland]

Thanks to all!