How to tell if Zombie agents are running - Is there a script?

[Laurie A. Krumrey]

Hi All,

After the 9/11 incident, I am being told to check all my HP-UX 11.0 and 11i servers for zombie agents' software.

Can someone enlighten me here? Also does anyone have a security script that checks for
any bad things happening and then emails you
a message if it finds problems?

We use bourne script. But I need to increase
the sercurity of my boxes and I think having
cron run some security scripts would be the way
to go?

Any idea's...
Laurie

[harry d brown jr · Accepted solution]

You might want to get a left handed wind shifter also. Someone is pulling your leg, so you might want to kick back. Tell them you need to reinstall the entire OS, and that the machines will be unavailable for two weeks and see how they react to that :-))

TO secure your servers, look at this:

http://people.hp.se/stevesk/bastion11.html

[Uday_S_Ankolekar]

Hello

run top command , that will show you how many zombie proecess are running.

U can also try ps -ef | grep defunct

Good luck..
-USA..

[James R. Ferguson]

Hi Laurie:

I think you will find this link is full of useful pointers:

http://www.hp.com/products1/unix/operating/hpux11i/alwayssecure.html

Included there is the whitepaper "Building a Bastion Host Using HP-UX 11":

http://www.hp.com/products1/unix/operating/hpux11i/infolibrary/building_a_bastion_host.pdf

Regards!

...JRF...

[Darrell Allen]

Hi Laurie,

I think someone may be confused in what they're telling you to look for (zombie agents' software?). It is good to be concerned with security, especially if your server is connected to the Internet. Even so, many security breaches come from within the organization. The rule of thumb is to only run the services you really need. That's the idea of a bastion host. Check out Harry's link and you may want to search hp.com (http://search.hp.com/ since the forums search hasn't been working well) for bastion or security. There's other threads in the forums you'll find interesting and helpful.

Darrell

[Wodisch]

Hello Laurie,

a "zombie" is a process in state "" (using "ps -ef") or "Z" (using "ps -el"). So you will catch them with
ps -ef | grep ""

But "zombie agent"? Real zombies are pretty bad agents - too slow, too stupid, and they do rot away pretty fast in a warm climate :-)

BTW, "zombie" is a perfectly natural state for EACH AND EVERY process at the end of its life: when a process dies (for whatever reason) it sends the signal "DEATH-OF-A-CHILD" to its parent process. Until the parent receives it, the process stays in mode "zombie". After the parent has received that signal, the "zombie" vanishes. A "zombie" being visible for some time is to be considered a bug, and can most often only be cured by rebooting... (sometimes sending a "kill -11" or "kill -14" helps).

Read some book about UN*X internals about the details.

Just my $0.02,
Wodisch

[A. Clay Stephenson]

Hi Laurie:

I think we may be suffering under a nomenclature problem here. I don't think your guys were talking about Zombie processes but rather programs which might 'wake up' and do terrible things. Viruses, worms, Trojan Horses, ... . These are not usually a problem on UNIX boxes but that doesn't mean that they might not be. You can start getting a handle on the security issues by subscribing to the HP Security Bulletins. Go to the ITRC->Maintenance & Support->Support Information Digests. There you can select security bulletins as well as patch notifications.

Clay