Security...Senior admin quit.

[John White]

What steps beyond disabling accounts, changing root password, closing the tunnel in the firewall, need to be taken when a highly skilled sys admin quits under less than happy circumstances?

[Robert Gamble]

pray

[Rick Garland]

The steps have been taken.

With the acct disabled, there is no access. Without the root passwd, can't really go that route either. You mentioned that outside access has been closed.

[Robert Gamble]

You may wish to turn off modems this weekend that the admin knows the phone #'s to.

Good Luck!

[James R. Ferguson]

John:

...but you STILL might want to keep HIS or HER phone number handy... :-))

...JRF...

[Kofi ARTHIABAH · Accepted solution]

I would suggest the following:

1. backup all your data; make sure that you have older backups available
2. perform a checksum of all executables and compare with a freshly installed machine. (in case a common commands such as su, netstat, ps etc. have been modified)
# sum /sbin/* /usr/sbin/* /bin/*
2b. do a full search of the servers for any scripts that may be lurking... you should know what each does.
3. obtain a copy of lsof (from the archive centre) and run it to ensure that no ports are stealthly open.
4. Check all cron jobs, at jobs to confirm that you know what they do.
5. check that you do not have strange entries in your $HOME/.rhosts and hosts.equiv

6. Keep an eye on traffic going into and out of your servers; verify that there are no MODEMs connected to any workstations/servers.

6. Worst-case scenario, do a clean install and restore your data (after validation) although I must say that most SAs I know are ethically minded and would not (no matter hoe unpleasant the circumstances are) subvert their former employers.

7. Now might be a good time to install tripwire http://www.tripwire.com/ to keep a track of what has changed on your systems.

Good luck.

[Kofi ARTHIABAH]

What are you trying to protect? Could an ftp initiated from inside your network with proprietary data be harmful to you? I think so - one does not need an account on the machine to get an automated process to fire off some data to an external machine... keep a very close eye on all traffic leaving your network as well!

[Alan Riggs]

The biggest danger from an unhappy admin leaving are the possibilities of backdoors and time bombs. Make a careful inspection of all root cron and at jobs. Make sure that not only do you know what each program/script ruin is supposed to do, you also verify that each program does nothing else/has not been changed recently.

Examine /etc/passwd and /etc/sudoers (if you use sudo) very carefully. Make sure not only the system passwd, but any other passwords/accounts he had access to have been changed.

Keep an eye on open network ports, make sure nothing mysterious is listening on your servers.

If you allow anonymous ftp, make sure the security around the ftp filesystem is still in place.

[Rick Garland]

A statement that Kofi mentioned, install tripwire.

Is a good security app to help you ensure that certain critical files have not been changed. Can get a copy from the COAST security site.

As mentioned, most SAs will not mess around with previous employers. I believe this amounts to a Federal Offense.

And yes, always have good backups handy.

[John White]

We have good backups and do not have modems attached to the servers. I am checking cron etc. now. Thanks for all the responses. I've been reading the forum for som months but this was my first posting. Again Thanks!

[paul courry]

One more thought......

Have a known good copy of your operating system with all patches, etc. ready to install if necessary. Also, show your night operator where the wires connecting this machine to the LAN are and how to pull them out if given the word. (paranoid yes, but I once had a colleague fired and my boss gave him 20 seconds at the keyboard, need I detail the damage he caused?)

[Madhu Sudhan_1]

My 2 cents.
One important thing is check your cron jobs immediately for any unncessary jobs that are scheduled which can cause disaster.

...Madhu

[Madhu Sudhan_1]

One more thoght. Do a thorow auditing of all the users in your system. There may be more than one account for him.

Did you guys sent him out properly with a farewell party ? :)

...Madhu

[Fred Martin_1]

I agree, review -all- your accounts. As an admin, I find that users are all too willing to give me their password. I have to clap my hands over my own ears in order to stop them.

As it is, I have several passwords in my head for people in our company, which I can't forget even if I wanted to.

Knowing what I know about the company's modems, firewall, unix, and software with security leaks, it would be very difficult for them to stop me if I wanted to get in.

If you fear this admin, I'd change every password in the place.