Hacked ? who, uptime, w ?
I just inherited some E's running solaris 8, the uptime and w command output is not right, uptime gives me:
uptime
2:33pm 0 users, load average: 0.24, 0.36, 0.24
w
2:33pm 0 users, load average: 0.17, 0.34, 0.23 User tty login@ idle JCPU PCPU wha
who -a
just returns a prompt, no output no matter the option
-r-xr-xr-x 37 root bin 5256 Jan 5 2000 /usr/bin/uptime
-r-xr-xr-x 37 root bin 5256 Jan 5 2000 /usr/bin/w
-r-xr-xr-x 1 root bin 13088 Apr 3 2001 /usr/bin/who
How do I check the validity of the files to make sure they were not replaced. I don't know the circumstances of the previous admin that left here. All the servers have the same file dates and size.
Thanks
RichP
[772 byte] By [
fistv] at [2007-11-25 23:20:40]
# 1
Use the pkgchk command for this type of stuff.
If you are only interested in if the file has a problem:
$ pkgchk -p /usr/bin/w
If the file matches what is in /var/sadm/install/contents, the pkgchk command will simply return to a command prompt. If there is a problem with the file, you'll get something back like this (I messed up my /usr/local/bin/egrep command on purpose to get this output):
$ pkgchk -p /usr/local/bin/egrep
ERROR: /usr/local/bin/egrep
permissions <0755> expected <0644> actual
group name <bin> expected <other> actual
owner name <bin> expected <root> actual
file size <34> expected <0> actual
file cksum <2351> expected <0> actual
To igure out which package these files came from and what the "expected" value for things is, e.g. size, checksum of contents, file owner, etc..
pkgchk -l -p /usr/bin/who
Pathname: /usr/bin/who
Type: regular file
Expected mode: 0555
Expected owner: root
Expected group: bin
Expected file size (bytes): 13080
Expected sum(1) of contents: 31735
Expected last modification: Jan 05 18:25:57 2000
Referenced by the following packages:
SUNWcsu
Current status: installed
This tells you what package this file came from and the expected value for various things. It doesn't do any checking of the expected values against the real file.
Of course, if you are REALLY suspect of a machine, your really can't trust /var/sadm/install/contents. Its not hard to vi the file and modify it to match what you hacked.
Another more painful way is to take a patch audit of the system and figure out if the files were modified by a recent patch. Hopefully one still on Sunsolve. Compare the command binary image in the patch with what is on the system. Hopefully they match.
