Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a CentOS box that's been up for about a year. It's not got anything hugely important on it, and had a lot of PHP code that I cannot personally vouch for and is fairly old. I realise this is asking for trouble.

I did the things I'm aware of to harden SSH and restrict access via IPTables etc. Today I've noticed a lot of worrying files in /usr/bin/ and /bin/. Lots of what looks like duplicates of binaries, created over a period of a couple of months at the rate of 20 or so a day:

-rw-r--r-- 1 root root 47024 Aug 7 2011 chage;4e3f01f7
-rw-r--r-- 1 root root 47024 Aug 7 2011 chage;4e3f1007
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f1e17
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f2c27
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f3a38
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f4846

The other binaries with similar going on are - newgrp, gpasswd, lastlog, dig, usleep and doexec.

The last file date is 8th August so I don't have any logs going back that far. Is anyone able to help me in understanding what has gone on here?

share|improve this question

migrated from stackoverflow.com Feb 7 '12 at 16:44

This question came from our site for professional and enthusiast programmers.

1 Answer 1

I can't tell you why it's happening, but those numbers after the ; look a lot like timestamps:

4e3f01f7 => Sun Aug  7 17:21:59 2011
4e3f1007 => Sun Aug  7 18:21:59 2011
4e3f1e17 => Sun Aug  7 19:21:59 2011
4e3f2c27 => Sun Aug  7 20:21:59 2011
4e3f3a38 => Sun Aug  7 21:22:00 2011
4e3f4846 => Sun Aug  7 22:21:58 2011

(seconds since the epoch in hex). By the fact that they're almost exactly a minute apart, I'd suspect maybe a cron job?

They're also the same size. Maybe you should check if they match with md5sum? or if they could even be the same file hardlinked? (check inode number in stat).

share|improve this answer
    
They wouldn’t have differing mtimes if they were hardlinked. –  Richard Kettlewell Feb 7 '12 at 19:23
    
Yep, you are right. Overlooked that earlier when I posted. –  FatalError Feb 7 '12 at 19:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.