Security: Check if anyone else has root to your server

**Kayla** · August 26th, 2004, 6:16 PM

1. Log in as the root user of your server
2. type cd /etc/cron.daily
3. then type pico -w chkuid0
4. Paste the following code:

Quote:

#!/bin/sh
#
# This script must be owned by root or at least setuid 0
# It will scan the system and mail the root user when another user gains uid 0.

for id in `awk 'FS=":" {if(($3 == 0 && $1 != "root" )) \
print $1}' /etc/passwd`
do

echo 'ALERT Login ID' `echo ${id}` 'has uid 0 !!' `date "+Detected On Date :%D Time :%r"` | mail -s "ALERT: User `echo ${id}` has UID O" webmaster[at]yoursite.com

5. Press Ctrl-X, and then press Y.
6. type chmod 755 chkuid0

**Travis** · August 27th, 2004, 1:10 AM

Why do some of the support people use public keys to get into the root?

**Dave** · August 27th, 2004, 8:52 PM

This script only detects if a new account was added with root powers. (UID 0) This would be a false sense of security, since most hackers just gain root using some exploit, plant a trojan, and leave.

August 27th, 2004, 1:10 AM	#2 (permalink)
Travis ubuntu Fan Super #1 Joined in Nov 2003 Lives in Calgary Alberta Canada 2,724 posts Gave thanks: 0 Thanked 0 times	Why do some of the support people use public keys to get into the root? __________________ "A lot of people are waiting for Martin Luther King or Mahatma Gandhi to come back -- but they are gone. We are it. It is up to us. It is up to you." — Marian Wright Edelman

August 27th, 2004, 8:52 PM	#3 (permalink)
Dave Third Plateau Comfy Contributor Joined in Apr 2004 Lives in East Hanover, New Jersey Hosted on Nifty 272 posts Gave thanks: 0 Thanked 0 times	This script only detects if a new account was added with root powers. (UID 0) This would be a false sense of security, since most hackers just gain root using some exploit, plant a trojan, and leave. __________________ site (syberdave.net) - server (nifty)

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)