[Full-disclosure] sshd logins without a source
guillaume.friloux at asp64.com
Fri Sep 23 10:10:01 BST 2011
On 23/09/2011 05:45, BH wrote:
> I am taking a look at a few different servers that have been rooted at
> around the same time. At the time of the compromise I can see in each
> servers sshd logs an entry like the following:
> Sep 22 12:57:14 test-vm sshd: pam_unix(sshd:session): session
> opened for user root by (uid=0)
> Sep 22 12:57:32 test-vm sshd: pam_unix(sshd:session): session
> closed for user root
> Each of the servers has the same sort of entry in the log that match
> with the time that extra processes were being executed. Having a look at
> all other available logs (that were logged remotely) I can't see
> anything else that relates to the same event. To me it seems odd that
> there is no IP address corresponding with the login, I can't seem to
> reproduce that on my test servers. I also can't see the authentication
> method used as that isn't logged. Has anyone seen this before and know
> how this is done?
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 172 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20110923/d32cb509/attachment.vcf
Full-Disclosure is hosted and sponsored by Secunia.