Log SSH Activity/ Keylogger
Oct 10, 2009I was just wondering is there any way to log SSH activity on server. or some sort of keylogger.
View 3 Replies
ADVERTISEMENT
Activity On Ports 1028 And 135
Jan 14, 2008my Windows 2003 server is showing a very steady amount of action on Port 1028 and Port 135.
The Process is listed as "Unknown" with a PID of 0
The Local IP is 127.0.0.1
The Remote IP is 127.0.0.1
The Remote Port is either 1028 or 135
The State is "TIME_WAIT"
The Protocol is TCP
The path to the executable is blank. At any given time there are at least 20 active processes of this. The virus scan says all is well.
SSH User Activity History
Sep 11, 2007Does CentOS4 logs every activity done by a SSH user? Or is there such script/software to do that?
View 10 Replies View RelatedLimiting User Activity
Jul 29, 2007I am interested in setup user activity limits to avoid peaks on the server load, I have readen a lot about PAM and limits.conf but still have no idea on how set this limits. Most of the examples are similar to this page http://www.seifried.org/lasg/users/ but they are still confusing to me
>> I would like to setup rules like this:
Customers may not use more than 2% CPU daily, 3% memory daily, run more than 10 simultaneous processes per user, allow any process to run for longer than 30 CPU seconds, run any process that consumes more than 20% of available CPU at any time, or run any process that consumes more than 16 MB of memory.
Jarhosts Limited (Fraudulant Activity)
Jan 23, 2009Last week, we received a letter [url] from Companies House (the UK entity which governs companies).
It was addressed to Exoware, with all the correct contact details, reminding me to submit statutory documents by a certain date or face a fine and/or prosecution.
It was sent to us, because apparently, Exoware is a director of Jarhosts limited. This is not true. We have never even heard of Jarhosts limited up to this point, but it appears they had ceased trading by the time we received the letter.
A few emails were exchanged between us and Companies House, which didn't really get us anywhere as they couldn't seem to understand our position, so I phoned them up myself. I got through to someone and explained our position and she informed me about the company and said they registered Exoware as a director of Jarhosts limited on 05/12/08 and they themselves promptly resigned from the company afterwards, so Exoware was the only remaining director.
After I declared that Exoware had no affiliation whatsoever with Jarhosts limited, she promptly forwarded the case to a department for dealing with fraudulent documents and said the company will dissolve soon and that we may hear from Companies House fraud department in the future.
So, my concerns are now at ease, but my curiosity still remains.
Does anybody know Jarhosts; how long they were around for, who they were owned by, or any relevant information about them? Or does anybody know of any reason that people would sign up a random business in the same industry as a director before bailing out of their own company? It all seems very obscure.
Highly Suspicious Activity - Log Files
Dec 17, 2007what to look out for in the log files, but a couple of things jumped out at me over the weekend:
I had 5 of these, I followed the link (I suppose is the referrer) but it takes you to a polish-hosted russian webpage that tries to infect your browser. So DONT VISIT THE WEBSITE unless you're virus checker is fully up to date!
Code:
shop.######.com: [15/Dec/2007:02:52:43 +0000] 87.118.120.23 - - "GET / HTTP/1.0" 200 21466 [url] (compatible; MSIE 6.0; Windows NT 5.2; Win64; AMD64)"
As this is only a GET, I'm not sure what the purpose of this really was.
Also I seem to be getting loads of these recently:
Code:
shop.######.com: [17/Dec/2007:08:21:41 +0000] 82.19.60.98 - - "GET /_vti_bin/index.php?main_page=page_not_found HTTP/1.1" 301 5 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)"
Which I read is an automated hacker-bot checking for an unpatched MS server.
So my question is this;
What's the most effective thing we (as webmasters/hosts) can do to combat and report this sort of thing so we fight back against what's likely to be related to organised crime?
Rogue Network Activity From Dedicated Box
Aug 6, 2007I have a dedicated box with Fasthosts and they tell me they've detected that the server is talking out to other networks via IRC although there's no activity on port 53.
Can anyone point me in the right direction of steps to take to find out what this is and eliminate it?
Recent changes to server include...
Started SpamAssassin (with network checks on - could these be the cause?)
Installed Mongrel as a proxy server for RoR apps and configured Apache on port 80 to make use of two Mongrel processes.
Some other data about server as requested on sticky thread on this board:
Linux OS: Fedora Core 6
Kernel: 2.6.18-1.2798.fc6
Control Panel: Matrix LSA
Processes (ps -auxf):
Quote:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2032 556 ? Ss Jul31 0:01 init [3]
root 2 0.0 0.0 0 0 ? S Jul31 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN Jul31 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S Jul31 0:00 [watchdog/0]
root 5 0.0 0.0 0 0 ? S Jul31 0:00 [migration/1]
root 6 0.0 0.0 0 0 ? SN Jul31 0:00 [ksoftirqd/1]
root 7 0.0 0.0 0 0 ? S Jul31 0:00 [watchdog/1]
root 8 0.0 0.0 0 0 ? S< Jul31 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S< Jul31 0:00 [events/1]
root 10 0.0 0.0 0 0 ? S< Jul31 0:00 [khelper]
root 11 0.0 0.0 0 0 ? S< Jul31 0:00 [kthread]
root 15 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kblockd/0]
root 16 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kblockd/1]
root 17 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kacpid]
root 123 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [cqueue/0]
root 124 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [cqueue/1]
root 127 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [khubd]
root 129 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kseriod]
root 194 0.0 0.0 0 0 ? S Jul31 0:00 \_ [pdflush]
root 196 0.0 0.0 0 0 ? S< Jul31 0:14 \_ [kswapd0]
root 197 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [aio/0]
root 198 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [aio/1]
root 363 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kpsmoused]
root 393 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata/0]
root 394 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata/1]
root 395 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [ata_aux]
root 399 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [scsi_eh_0]
root 400 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [scsi_eh_1]
root 401 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kjournald]
root 421 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kauditd]
root 1305 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [hda_codec]
root 1461 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmpathd/0]
root 1462 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmpathd/1]
root 1469 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kmirrord]
root 1491 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [kjournald]
root 1493 0.0 0.0 0 0 ? S< Jul31 0:01 \_ [kjournald]
root 1495 0.0 0.0 0 0 ? S< Jul31 0:07 \_ [kjournald]
root 2105 0.0 0.0 0 0 ? S< Jul31 0:02 \_ [rpciod/0]
root 2106 0.0 0.0 0 0 ? S< Jul31 0:00 \_ [rpciod/1]
root 2143 0.0 0.0 0 0 ? S Aug04 0:00 \_ [pdflush]
root 447 0.0 0.0 2212 332 ? S<s Jul31 0:00 /sbin/udevd -d
root 1629 0.0 0.0 1624 364 ? Ss Jul31 0:00 cpuspeed -d -n
root 1630 0.0 0.0 1624 348 ? S Jul31 0:00 \_ cpuspeed -d -n
root 1931 0.0 0.0 1692 580 ? Ss Jul31 0:06 syslogd -m 0
root 1934 0.0 0.0 1640 316 ? Ss Jul31 0:00 klogd -x
root 1943 0.0 0.0 1632 280 ? Ss Jul31 0:00 irqbalance
rpc 1964 0.0 0.0 1776 416 ? Ss Jul31 0:00 portmap
root 1982 0.0 0.0 1884 604 ? Ss Jul31 0:00 rpc.statd
root 1989 0.0 0.0 1628 232 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/spool/authdaemon/pid -star
root 1990 0.0 0.0 2120 544 ? S Jul31 0:00 \_ /usr/libexec/courier-authlib/authdaemond
root 2008 0.0 0.1 2964 1452 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2009 0.0 0.0 2172 752 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2010 0.0 0.1 2584 1172 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2011 0.0 0.0 2172 752 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2012 0.0 0.1 2964 1456 ? S Jul31 0:01 \_ /usr/libexec/courier-authlib/authdaemond
root 2022 0.0 0.0 4932 308 ? Ss Jul31 0:00 rpc.idmapd
dbus 2034 0.0 0.0 3140 308 ? Ss Jul31 0:00 dbus-daemon --system
root 2042 0.0 0.0 2344 416 ? Ss Jul31 0:00 hcid: processing events
root 2048 0.0 0.0 1712 368 ? Ss Jul31 0:00 /usr/sbin/sdpd
root 2072 0.0 0.0 0 0 ? S< Jul31 0:00 [krfcommd]
root 2107 0.0 0.0 0 0 ? S Jul31 0:00 [lockd]
root 2124 0.0 0.0 12692 552 ? Ssl Jul31 0:00 pcscd
root 2141 0.0 0.0 1876 348 ? Ss Jul31 0:00 /usr/bin/hidd --server
root 2154 0.0 0.0 9044 708 ? Ssl Jul31 0:00 automount
root 2170 0.0 0.0 1640 392 ? Ss Jul31 0:00 /usr/sbin/acpid
root 2187 0.0 0.0 5172 716 ? Ss Jul31 0:02 /usr/sbin/sshd
root 14427 0.0 0.2 8172 2468 ? Ss 14:09 0:00 \_ sshd: root@pts/0
root 14432 0.0 0.1 4620 1472 pts/0 Ss 14:09 0:00 \_ -bash
root 17290 0.0 0.0 4192 936 pts/0 R+ 16:35 0:00 \_ ps -auxf
root 2258 0.0 0.0 4488 544 ? S Jul31 0:00 /bin/sh /usr/bin/mysqld_safe --defaults-file=/etc/my.cnf --p
mysql 2294 0.0 0.6 139508 6432 ? Sl Jul31 1:26 \_ /usr/libexec/mysqld --defaults-file=/etc/my.cnf --basedi
root 2401 0.0 0.1 6240 1344 ? Ss Jul31 0:06 /usr/libexec/postfix/master
postfix 20416 0.0 0.1 6484 1612 ? S Aug03 0:01 \_ qmgr -l -t fifo -u
postfix 16541 0.0 0.1 6300 1664 ? S 15:31 0:00 \_ pickup -l -t fifo -u
postfix 17111 0.0 0.1 6292 1644 ? S 16:21 0:00 \_ anvil -l -t unix -u
postfix 17248 0.0 0.1 6308 1980 ? S 16:33 0:00 \_ trivial-rewrite -n rewrite -t unix -u
postfix 17273 0.0 0.1 6468 1876 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17274 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17275 0.0 0.1 6468 1876 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17276 0.0 0.1 6464 1832 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17277 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17278 0.0 0.1 6468 1880 ? S 16:34 0:00 \_ smtp -t unix -u
postfix 17281 0.0 0.1 6340 1660 ? S 16:34 0:00 \_ bounce -z -n defer -t unix -u
postfix 17283 0.0 0.1 6340 1640 ? S 16:34 0:00 \_ bounce -z -n defer -t unix -u
root 2411 0.0 0.0 1864 292 ? Ss Jul31 0:00 gpm -m /dev/input/mice -t exps2
root 2434 0.0 0.1 5804 1648 ? Ss Jul31 0:00 /usr/sbin/httpd-matrixsa
apache 15100 0.0 0.1 5948 1856 ? S Aug05 0:00 \_ /usr/sbin/httpd-matrixsa
apache 15101 0.0 0.1 5948 1704 ? S Aug05 0:00 \_ /usr/sbin/httpd-matrixsa
apache 14593 0.0 0.1 5948 1852 ? S 14:22 0:00 \_ /usr/sbin/httpd-matrixsa
root 2442 0.0 0.0 5216 596 ? Ss Jul31 0:00 crond
xfs 2465 0.0 0.0 3132 548 ? Ss Jul31 0:00 xfs -droppriv -daemon
root 2480 0.0 0.0 2204 348 ? Ss Jul31 0:00 /usr/sbin/atd
root 2501 0.0 0.1 24212 1372 ? S Jul31 0:00 /usr/bin/python /usr/sbin/yum-updatesd
avahi 2510 0.0 0.0 2864 612 ? Ss Jul31 0:00 avahi-daemon: running [server88-208-201-113.local]
avahi 2511 0.0 0.0 2864 124 ? Ss Jul31 0:00 \_ avahi-daemon: chroot helper process
68 2520 0.0 0.1 5708 1100 ? Ss Jul31 0:00 hald
root 2522 0.0 0.0 3336 520 ? S Jul31 0:00 \_ hald-runner
68 2553 0.0 0.0 2292 568 ? S Jul31 0:00 \_ hald-addon-acpi: listening on acpid socket /var/run/
root 2554 0.0 0.0 3392 520 ? S Jul31 0:00 \_ /usr/libexec/hald-addon-cpufreq
68 2560 0.0 0.0 2288 564 ? S Jul31 0:00 \_ hald-addon-keyboard: listening on /dev/input/event2
68 2563 0.0 0.0 2288 564 ? S Jul31 0:00 \_ hald-addon-keyboard: listening on /dev/input/event0
ntp 2607 0.0 0.0 4128 944 ? Ss Jul31 0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
root 2667 0.0 0.0 1628 380 tty1 Ss+ Jul31 0:00 /sbin/mingetty tty1
root 2668 0.0 0.0 1628 360 tty2 Ss+ Jul31 0:00 /sbin/mingetty tty2
root 2671 0.0 0.0 1628 360 tty3 Ss+ Jul31 0:00 /sbin/mingetty tty3
root 2672 0.0 0.0 1628 360 tty4 Ss+ Jul31 0:00 /sbin/mingetty tty4
root 2673 0.0 0.0 1628 360 tty5 Ss+ Jul31 0:00 /sbin/mingetty tty5
root 2683 0.0 0.0 1628 360 tty6 Ss+ Jul31 0:00 /sbin/mingetty tty6
root 4656 0.0 0.0 1628 296 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd.pid -start -name
root 4657 0.0 0.0 1732 504 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
1003 8661 0.0 0.1 2344 1316 ? S 10:00 0:11 \_ /usr/lib/courier-imap/bin/imapd /home/default/polloc
1001 9528 0.2 0.2 3860 2772 ? S 10:24 1:05 \_ /usr/lib/courier-imap/bin/imapd /home/default/aaronp
1003 15914 0.0 0.1 2200 1072 ? S 14:43 0:00 \_ /usr/lib/courier-imap/bin/imapd /home/default/polloc
1001 17199 0.0 0.0 2124 1020 ? S 16:27 0:00 \_ /usr/lib/courier-imap/bin/imapd /home/default/aaronp
root 4663 0.0 0.0 1632 168 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/imapd-ssl.pid -start -
root 4664 0.0 0.0 1732 428 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 4669 0.0 0.0 1632 300 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d.pid -start -name
root 4670 0.0 0.0 1732 500 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 4675 0.0 0.0 1628 168 ? S Jul31 0:00 /usr/sbin/courierlogger -pid=/var/run/pop3d-ssl.pid -start -
root 4676 0.0 0.0 1736 428 ? S Jul31 0:00 \_ /usr/lib/courier-imap/libexec/couriertcpd -address=0 -ma
root 14860 0.0 1.5 33316 15544 ? Ss Aug03 0:01 /usr/sbin/httpd
apache 30327 0.0 2.1 43480 21688 ? S 01:55 0:16 \_ /usr/sbin/httpd
apache 30328 0.0 2.0 43220 21180 ? S 01:55 0:15 \_ /usr/sbin/httpd
apache 30329 0.0 2.1 43616 21868 ? S 01:55 0:13 \_ /usr/sbin/httpd
apache 30330 0.0 2.1 44132 22308 ? S 01:55 0:16 \_ /usr/sbin/httpd
apache 30331 0.0 2.2 44660 23384 ? S 01:55 0:15 \_ /usr/sbin/httpd
apache 30332 0.0 2.2 44604 22820 ? S 01:55 0:14 \_ /usr/sbin/httpd
apache 30333 0.0 2.0 43576 21532 ? S 01:55 0:17 \_ /usr/sbin/httpd
apache 30334 0.0 2.1 43908 22064 ? S 01:55 0:17 \_ /usr/sbin/httpd
apache 11425 0.0 1.9 42328 20276 ? S 10:53 0:12 \_ /usr/sbin/httpd
apache 16125 0.0 1.6 40572 17052 ? S 15:04 0:01 \_ /usr/sbin/httpd
apache 16126 0.0 1.6 40564 16696 ? S 15:04 0:01 \_ /usr/sbin/httpd
apache 16581 0.0 1.5 40508 16412 ? S 15:34 0:00 \_ /usr/sbin/httpd
apache 16582 0.0 1.6 40612 16436 ? S 15:34 0:00 \_ /usr/sbin/httpd
apache 16637 0.0 1.6 40496 16660 ? S 15:38 0:00 \_ /usr/sbin/httpd
mongrel 15242 0.0 2.8 45536 29104 ? Sl Aug03 0:03 /usr/bin/ruby /usr/bin/mongrel_rails start -d -e production
mongrel 15245 0.0 0.0 42184 828 ? Sl Aug03 0:02 /usr/bin/ruby /usr/bin/mongrel_rails start -d -e production
apache 27873 0.0 0.0 1608 244 ? Ss Aug04 0:00 /usr/local/apache/bin/httpd -DSSL
apache 28536 0.0 0.2 4556 2408 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
apache 32052 0.0 0.2 4552 2400 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
apache 32094 0.0 0.2 4552 2400 ? S Aug04 0:01 /usr/local/apache/bin/httpd -DSSL
root 15106 0.0 0.2 9836 2056 ? Ss Aug05 0:00 cupsd
root 15135 0.0 1.2 90504 12360 ? Sl Aug05 0:11 python2 MatrixSALaunch.py ThreadedAppServer
apache 19934 0.0 0.3 6096 3864 ? S Aug05 0:00 /usr/local/apache/bin/httpd -DSSL
1001 8664 0.0 0.1 2524 1044 ? S 10:00 0:00 /usr/libexec/gam_server
1003 8666 0.0 0.1 2528 1040 ? S 10:00 0:00 /usr/libexec/gam_server
root 17068 0.0 2.6 31508 27016 ? Ss 16:16 0:00 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid
root 17070 0.1 2.8 33752 29236 ? S 16:17 0:01 \_ spamd child
root 17071 0.0 2.7 32432 27772 ? S 16:17 0:00 \_ spamd child
vmstat 5 5:
Quote:
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 1 86800 26008 285380 234780 0 0 3 10 21 1 0 0 99 0 0
0 0 86800 26716 285396 234792 0 0 0 98 289 538 4 1 94 0 0
0 0 86800 26764 285404 234792 0 0 0 62 254 333 0 0 100 0 0
0 0 86800 26772 285404 234792 0 0 0 0 255 346 0 0 100 0 0
0 0 86800 26772 285416 234792 0 0 0 16 253 408 0 0 100 0 0
Apachetop / Munin / Nagios - Best Way To View Apache + Other Service Activity
Nov 12, 2008On Cpanel/WHM. I have just moved from a VPS to a dedicated server. I reinstalled munin, so get some stats via that. I used to have apachetop loaded on my VPS for when I wanted a 'near realtime' streaming view of apache access.
I'm wondering what the best solution is to get a good view of apache, like what apachetop did, plus also it would be nice to have a real-time monitor of MySQL activity, HDD activity (such as I/O queues, etc. Something along the lines of the perfmon on Windows servers.
What is my best option?
Also, with Nagios, when I look at the website, it seems there are two options. Load it on a single server and then load the stats via [url]or have the Nagios 'stat collector' on one machine, and have it gathering stats from multiple machines.
If you only install it on a single dedicated server, do you really have to be on the console and connect to the Nagios stats via localhost, rather than connecting remotely?
Ideally, I would like a quick, easy to setup solution, but if it takes some configuring, I can deal with it, as long as there is some documentation. My main goal is to get the real time type monitoring, you get with window's perfmon.
Trojan Activity - Running Perl With High CPU Usage, With User Apache
Sep 5, 2007Running programs named Perl with Heavy CPU usage, with the ownership of user apache.
We found the problem on Fedora 3 and Fedora 6.
In our case, it was the result of a Trojan activity.
Quick Solution
Check the cron jobs of user apache
crontab -u apache -e
*/1 * * * * perl /tmp/.tmp/tmpfile
delete the cronjob entry.
Also delete the file /tmp/.tmp/tmpfile
also added "apache" to the file /etc/cron.deny
That's all
Problem and solution in detail....