how do i change PermitRootLogin option to no? - GoFuckYourself.com

GFED · 04-28-2006, 12:16 AM

[03:00:08] ------------------------- Security advisories -------------------------
[03:00:09] Info: Found no explicit values, but a default value of 'yes'
[03:00:09] Warning: root login possible. Change for your safety the 'PermitRootLogin'
[03:00:09] (into 'no') and use 'su -' to become root.
[03:00:09] Found default option Protocol 2,1
[03:00:09] Warning: SSH version 1 possible allowed!
[03:00:09] Hint: Change the 'Protocol xxx' line into 'Protocol 2'
[03:00:13] Scanned for: 55808 Trojan - Variant A, AjaKit, aPa Kit, Apache Worm, Ambient (ark) Rootkit, Balaur Rootkit, BeastKit, beX2, BOBKit, CiNIK Worm (Slapper.B variant), Danny-Boy's Abuse Kit, Devil RootKit, Dica, Dreams Rootkit, Duarawkz, Flea Linux Rootkit, FreeBSD Rootkit, Fuck`it Rootkit, GasKit, Heroin LKM, HjC Kit, ignoKit, ImperalsS-FBRK, Irix Rootkit, Kitko, Knark, Li0n Worm, Lockit / LJK2, MRK, Ni0 Rootkit, RootKit for SunOS / NSDAP, Optic Kit (Tux), Oz Rootkit, Portacelo, R3dstorm Toolkit, RH-Sharpe's rootkit, RSHA's rootkit, Scalper Worm, Shutdown, SHV4, SHV5, Sin Rootkit, Slapper, Sneakin Rootkit, Suckit Rootkit, SunOS Rootkit, Superkit, TBD (Telnet BackDoor), TeLeKiT, T0rn Rootkit, Trojanit Kit, Tuxtendo, URK, VcKit, Volc Rootkit, X-Org SunOS Rootkit, zaRwT.KiT Rootkit
[03:00:13] 2 vulnerable applications found

GFED · 04-28-2006, 12:22 AM

i ran chkrootkit and rkhunter but neither seems to remove anything... :/

GFED · 04-28-2006, 12:29 AM

i'm probably gonna be forced to back everything up and put it back on a freshly imaged server... but i'm taking this opportunity to learn a little bit about server admining which i know nothing about... i'd like to know how the hacker got in and how to prevent it from happening again...

links i've been reading are http://www.webhostingtalk.com/archiv.../404840-1.html and http://www.cert.org/tech_tips/win-UN...ompromise.html

and other useful links, and input is appreciated...

studiocritic · 04-28-2006, 12:58 AM

it's an sshd configuration option.. depending on which sshd and what os you're using.. that file might live in several places

bbe · 04-28-2006, 12:59 AM

change "PermitRootLogin yes" to no in /etc/ssh/sshd_config

studiocritic · 04-28-2006, 01:00 AM

try doing
locate sshd2_config

studiocritic · 04-28-2006, 01:00 AM

Quote:

Originally Posted by bbe

change "PermitRootLogin yes" to no in /etc/ssh/sshd_config

his paste showed ssh v2.. i'm assuming he's got sshd2

GFED · 04-28-2006, 01:03 AM

ty... the option has a # in front... that means it's a comment right? i should change it to no and take the # out?

GFED · 04-28-2006, 01:04 AM

Quote:

Originally Posted by studiocritic

his paste showed ssh v2.. i'm assuming he's got sshd2

nothing found for that filename...

GFED · 04-28-2006, 01:05 AM

i'll rerun rkhunter and see what it says...

GFED · 04-28-2006, 01:20 AM

oki, it worked with the # intact... i also changed from protocol 2,1 to protocol 2

vantage · 04-28-2006, 01:23 AM

and; killall -HUP sshd

GFED · 04-28-2006, 01:42 AM

oki this is what i have now...

MD5
MD5 compared: 0
Incorrect MD5 checksums: 0

File scan
Scanned files: 342
Possible infected files: 2
Possible rootkits: SHV4 SHV5

Application scan
Vulnerable applications: 2

Scanning took 1315 seconds
Scan results written to logfile (/var/log/rkhunter.log)

prime · 04-28-2006, 03:47 AM

dude, the only fix there is to back up your files
and
reinstall

fris · 04-28-2006, 03:48 AM

i use openssh rather than the default ssh

GFED · 05-01-2006, 07:27 AM

i'm really in a bind... i dont remember how i setup the dns and everything on it... and i dont want my sites to be down too long... its so much work.. and theyll just hack it again... :/

drjones · 05-01-2006, 07:44 AM

Once a rootkit has comprimised your system, theres no choice but to reinstall. You can remove the rootkit, but someone has had root access to your machine.. they could literally do anything once inside, and theres no way to know, if they're smart.

Consider virtualization or chroot jails for all your services if your running more than one on the same machine (DNS, Apache etc). Lock everything down as tight as possible (firewalls, /etc/hosts.deny, /etc/hosts.allow, SELinux if you have it etc).

Most importantly back up all those configuration files!!! Back them up! Then if you do get compromised, you can easily be back up and running again in no time.

marketsmart · 05-01-2006, 07:47 AM

^
|
what he said -----

GFED · 05-01-2006, 09:35 AM

is there any server admins here that can help me get everything set back up? and how much would it cost? :/

mrkris · 05-01-2006, 09:49 AM

gfeds, hit me up on icq.

04-28-2006, 12:16 AM	#1
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	how do i change PermitRootLogin option to no? [03:00:08] ------------------------- Security advisories ------------------------- [03:00:09] Info: Found no explicit values, but a default value of 'yes' [03:00:09] Warning: root login possible. Change for your safety the 'PermitRootLogin' [03:00:09] (into 'no') and use 'su -' to become root. [03:00:09] Found default option Protocol 2,1 [03:00:09] Warning: SSH version 1 possible allowed! [03:00:09] Hint: Change the 'Protocol xxx' line into 'Protocol 2' [03:00:13] Scanned for: 55808 Trojan - Variant A, AjaKit, aPa Kit, Apache Worm, Ambient (ark) Rootkit, Balaur Rootkit, BeastKit, beX2, BOBKit, CiNIK Worm (Slapper.B variant), Danny-Boy's Abuse Kit, Devil RootKit, Dica, Dreams Rootkit, Duarawkz, Flea Linux Rootkit, FreeBSD Rootkit, Fuck`it Rootkit, GasKit, Heroin LKM, HjC Kit, ignoKit, ImperalsS-FBRK, Irix Rootkit, Kitko, Knark, Li0n Worm, Lockit / LJK2, MRK, Ni0 Rootkit, RootKit for SunOS / NSDAP, Optic Kit (Tux), Oz Rootkit, Portacelo, R3dstorm Toolkit, RH-Sharpe's rootkit, RSHA's rootkit, Scalper Worm, Shutdown, SHV4, SHV5, Sin Rootkit, Slapper, Sneakin Rootkit, Suckit Rootkit, SunOS Rootkit, Superkit, TBD (Telnet BackDoor), TeLeKiT, T0rn Rootkit, Trojanit Kit, Tuxtendo, URK, VcKit, Volc Rootkit, X-Org SunOS Rootkit, zaRwT.KiT Rootkit [03:00:13] 2 vulnerable applications found __________________ https://www.flow.page/savethechildren

04-28-2006, 12:22 AM	#2
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	i ran chkrootkit and rkhunter but neither seems to remove anything... :/ __________________ https://www.flow.page/savethechildren

04-28-2006, 12:29 AM	#3
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	i'm probably gonna be forced to back everything up and put it back on a freshly imaged server... but i'm taking this opportunity to learn a little bit about server admining which i know nothing about... i'd like to know how the hacker got in and how to prevent it from happening again... links i've been reading are http://www.webhostingtalk.com/archiv.../404840-1.html and http://www.cert.org/tech_tips/win-UN...ompromise.html and other useful links, and input is appreciated... __________________ https://www.flow.page/savethechildren

04-28-2006, 12:58 AM	#4
studiocritic Confirmed User Join Date: Jun 2005 Location: Irvine, CA Posts: 2,442	it's an sshd configuration option.. depending on which sshd and what os you're using.. that file might live in several places __________________ 254342256

04-28-2006, 01:00 AM	#6
studiocritic Confirmed User Join Date: Jun 2005 Location: Irvine, CA Posts: 2,442	try doing locate sshd2_config __________________ 254342256

04-28-2006, 12:59 AM	#5
bbe Confirmed User Join Date: Feb 2005 Posts: 110	change "PermitRootLogin yes" to no in /etc/ssh/sshd_config

04-28-2006, 01:03 AM	#8
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	ty... the option has a # in front... that means it's a comment right? i should change it to no and take the # out? __________________ https://www.flow.page/savethechildren

04-28-2006, 01:05 AM	#10
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	i'll rerun rkhunter and see what it says... __________________ https://www.flow.page/savethechildren

04-28-2006, 01:20 AM	#11
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	oki, it worked with the # intact... i also changed from protocol 2,1 to protocol 2 __________________ https://www.flow.page/savethechildren

04-28-2006, 01:23 AM	#12
vantage Confirmed User Join Date: Jun 2005 Location: BERLIN :: GERMANY Posts: 214	and; killall -HUP sshd __________________

04-28-2006, 01:42 AM	#13
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	oki this is what i have now... MD5 MD5 compared: 0 Incorrect MD5 checksums: 0 File scan Scanned files: 342 Possible infected files: 2 Possible rootkits: SHV4 SHV5 Application scan Vulnerable applications: 2 Scanning took 1315 seconds Scan results written to logfile (/var/log/rkhunter.log) __________________ https://www.flow.page/savethechildren

04-28-2006, 03:47 AM	#14
prime Confirmed User Join Date: Feb 2005 Location: Manila Posts: 400	dude, the only fix there is to back up your files and reinstall __________________ \| offshore solutions \| manual labor \| staff leasing \| and more! Dedicated -Motivated-Managed Employees icq.: 309570461 live chat

04-28-2006, 03:48 AM	#15
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,382	i use openssh rather than the default ssh __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

05-01-2006, 07:27 AM	#16
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	i'm really in a bind... i dont remember how i setup the dns and everything on it... and i dont want my sites to be down too long... its so much work.. and theyll just hack it again... :/ __________________ https://www.flow.page/savethechildren

05-01-2006, 07:44 AM	#17
drjones Confirmed User Join Date: Oct 2005 Location: Charlotte, NC Posts: 908	Once a rootkit has comprimised your system, theres no choice but to reinstall. You can remove the rootkit, but someone has had root access to your machine.. they could literally do anything once inside, and theres no way to know, if they're smart. Consider virtualization or chroot jails for all your services if your running more than one on the same machine (DNS, Apache etc). Lock everything down as tight as possible (firewalls, /etc/hosts.deny, /etc/hosts.allow, SELinux if you have it etc). Most importantly back up all those configuration files!!! Back them up! Then if you do get compromised, you can easily be back up and running again in no time.

05-01-2006, 07:47 AM	#18
marketsmart HOMICIDAL TROLL KILLER Industry Role: Join Date: Dec 2004 Location: Sunnybrook Institution for the Criminally Insane Posts: 20,419	^ \| what he said -----

05-01-2006, 09:35 AM	#19
GFED Confirmed User Industry Role: Join Date: May 2002 Posts: 8,120	is there any server admins here that can help me get everything set back up? and how much would it cost? :/ __________________ https://www.flow.page/savethechildren

05-01-2006, 09:49 AM	#20
mrkris Confirmed User Join Date: May 2005 Posts: 2,737	gfeds, hit me up on icq. __________________ PHP-MySQL-Rails \| ICQ: 342500546