News:

Rule #1 - Be Patient - Rule #2 - Don't ask when, if you don't contribute - Rule #3 - You have coding skills - LinuxMCE's small brother is available: http://www.agocontrol.com

Main Menu

Security breach?

Started by chrisbirkinshaw, November 29, 2007, 07:44:34 PM

Previous topic - Next topic
Print
Go Down Pages1
User actions

chrisbirkinshaw

November 29, 2007, 07:44:34 PM
I have just seen the following when typing "screen -r"

        9876.RemoteAssistance_SSH_NoMon_pf      (Detached)
        9828.RemoteAssistance_Web_pf    (Detached)
        9771.RemoteAssistance_SSH_pf    (Detached)

I have never seen these before and certainly haven't enabled remote assistance. Has my system been compromised?

Thanks,

Chris

totallymaxed

#1
December 01, 2007, 12:20:38 PM
Quote from: chrisbirkinshaw on November 29, 2007, 07:44:34 PM
I have just seen the following when typing "screen -r"

        9876.RemoteAssistance_SSH_NoMon_pf      (Detached)
        9828.RemoteAssistance_Web_pf    (Detached)
        9771.RemoteAssistance_SSH_pf    (Detached)

I have never seen these before and certainly haven't enabled remote assistance. Has my system been compromised?

Thanks,

Chris


Hi Chris,

Hmmm... that does seem a little strange. I would suggest that you Mantis this so that it can be investigated or past as 'normal'

You can add this to the Mantis bug tracking Db here http://mantis.linuxmce.org/my_view_page.php

Andrew
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

chrisbirkinshaw

#2
December 04, 2007, 07:09:43 PM
Found this:

tail -f /var/log/pluto/pluto.log
1       12/04/07 17:44:02       /usr/pluto/bin/SetupRemoteAccess.sh (server)    Crontab entry (special) already present. Not adding.
1       12/04/07 17:44:02       /usr/pluto/bin/RA_ChangePassword.sh (server)    User 'remote' already exists. Not adding.
1       12/04/07 17:44:02       /usr/pluto/bin/RA_ChangePassword.sh (server)    Setting password for 'remote' user
1       12/04/07 17:44:02       /usr/pluto/bin/SetupRemoteAccess.sh (server)    SSH_pf tunnel already present. Not enabling.
1       12/04/07 17:44:03       /usr/pluto/bin/SetupRemoteAccess.sh (server)    SSH_ph tunnel enabled.
1       12/04/07 17:44:03       /usr/pluto/bin/SetupRemoteAccess.sh (server)    Web_pf tunnel already present. Not enabling.
1       12/04/07 17:44:03       /usr/pluto/bin/SetupRemoteAccess.sh (server)    Web_ph tunnel enabled.


# more /etc/cron.d/SetupRemoteAccess
*/1 * * * * root /usr/pluto/bin/SetupRemoteAccess.sh

# more /etc/cron.d/SetupRA-Special
*/10 * * * * root /usr/pluto/bin/SetupRA-Special.sh
Print
Go Up Pages1
User actions