Utility like PCAnywhere

[sdip]

Dear gurus -

Do you know any utility available in HP-UX which can used like PC ANywhere software. Actually I beleive somebody is hacking our system. I would like to know how they did the same.

[Sridhar Bhaskarla]

Hi Sdip,

There is SharedX but acts a bit like PC Anywhere but one has to allow them to use ShareX and you will see the such windows as "Shared".

Check for last successful logins, IP addresses where the logins are from etc. using 'last' command. You can also check the history of root and the users that you think are compromised.

-Sri

[Steven E. Protter]

A utility like pcanywhere won't tell you a thing. If you have xfs set to enable in /etc/rc.config.d/xfs file you can use X emulation software to have an X desktop.

In there you could do the following:

tail -f /var/adm/syslog/syslog.log and track logins.

To look for evidence of hacking you can carefully monitor the wtmp and btmp files or copy them off regulalry with a date stamp if the hacker is cleaning up after him/herself.

Go through /etc/passwd and see if the hacker has set up an account for him/herself. Check for copies of ksh or sh that have suid set therefore letting the user become root.

A really good product to get is commerical tripwire. If the hacker is messing with log files or configuration files to cover his/her tracks tripwire will spot it and let you know what ws done and how.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Will harden your system against hackers.

It requires:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=PERL

HIDS will help spot hackers as well:

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5083AA

SEP

[Yogeeraj_1]

hi,

there is also the VNC software that can be used (only if the server processes are running).

You may wish to install an Intrusion Prevention software so that this do not recur in the future..

good luck!
regards
Yogeeraj

[Jim Allan]

if a hacker has breached your system, i doubt they will be using a graphical client to do so..

as someone said previously, monitor syslog for logins, and use the command 'last' to see what users have been logging in and for how long (wtmp)

check for any major logs that have been 0-byted (/var/adm/syslog/syslog.log)