Ubuntu Forums Archive Viewer

Has root been re-enabled on this machine?

Archived thread 1000769 from Security. Markdown source: Security/thread_1000769_Has_root_been_re-enabled_on_this_machine.md

Original URL About this archive
#1

Someone who is not usually a Ubuntu user sent me an excerpt from the auth.log file on a machine he has inherited. It contained a line similar to (I've removed the IP address for various reasons)

Accepted password for root from xx.yyy.zzz.abc port 44953 ssh2

Our question is 'Are we right in assuming that one of our users has re-enabled root on this machine or is their another way this could have happened?'

Cheers, Mike

#2

That looks like an actual login as root indeed. You better not allow ssh logins as root at all. Since you didn't know about it, I'd say your server has been compromised.

#3

when in doubt, consider your computer as compromised and re-setup everything.

#4

To verify it has been enabled


sudo getent shadow root|cut -d : -f 2

The output should be a "!", but since it has been enabled, it probably looks something like: $1$Hkx3o9Ri$Usb1jHwI7seZZAzNQMN4X.

To re-disable root:


sudo usermod -p ! root

To verify it is disabled


sudo getent shadow root|cut -d : -f 2

The output should be a "!".

When the password hash is set to "!", there is no valid password for that account. That would mean an event like the one referred to in your log would be impossible unless someone set a password for root.

Obviously, you don't know what that person did when they remotely logged in as root, so you can't trust that system anymore. I suggest reinstalling from scratch.

#5

Thanks for the information and advice. The machine in question is being wiped.

Best wishes, Mike

#6

MikeCr said: Thanks for the information and advice. The machine in question is being wiped.

Best wishes, Mike

If you believe that the machine or data on it has been otherwise compromised, that's not a bad idea. It's not necessary to in order re-disable the root account, though.

#7

root doesn't enable itself... and someone logged in... and I think the TO would know if he did that... as he is surprised, the only real good thing he could do is (a) make a backup and safe evidence for forensic and then (b) wipe and reinstall the machine.