[SOLVED] Slackware iptables hacked

Gary Baker · 01-11-2016, 05:55 AM

Was running Slackware 14.1 with iptables when noticed commands in history that were not mine and permissions had changed on some files. The firewall rules were very simple

Input drop
Forward drop
Output drop

With established,related rule.

What did I do wrong.

Thanks to all for help.

Tonus · 01-11-2016, 06:01 AM

Physical access and password guessed ?

Did you scanned for rootkits ?

Gary Baker · 01-11-2016, 06:13 AM

Did not scan for root kits.
No physical access possible.
Possible to have guessed password.

Tonus · 01-11-2016, 06:19 AM

Try rootkit hunter and chkrootkit.

Change password to stronger one.

What commands where passed and wich file permissions have been modified ?

Gary Baker · 01-11-2016, 06:47 AM

The entire home directory was modified to permission 1755 from 755.
Programs containing commands were removed from /use/bin.
Thanks for your help.

unSpawn · 01-11-2016, 05:09 PM

Quote:

Originally Posted by Gary Baker

The entire home directory was modified to permission 1755 from 755.
Programs containing commands were removed from /use/bin.

/usr/bin and contents is owned by root.
So you got yourself a root compromise.
Removing those files is not enough.