2

I'm still really new to linux, so I haven't gotten around to learning how to use log files.

I left my laptop on overnight, and I came back this morning to find a weird folder in my home directory. I don't remember seeing it there throughout the day before I went AFK at 3pm, but it says it was created at 9:55am.

File: '栯浯⽥敭档捡睯ⸯ慣档⽥敷止瑩椯潣摮瑡扡獡e'
  Size: 4096        Blocks: 8          IO Block: 4096   directory
Device: 804h/2052d  Inode: 2231938     Links: 2
Access: (0700/drwx------)  Uid: ( 1000/mechacow)   Gid: ( 1000/mechacow)
Access: 2016-09-21 07:47:07.406956104 -0400
Modify: 2016-09-20 09:55:45.511971378 -0400
Change: 2016-09-21 07:47:02.826910157 -0400
 Birth: -

I decided to invesitgate, and was told that /var/log/auth.log could help me. I found some weird activity that stuck out from the rest of the log that happened about twenty minutes prior to the last time the file was modified. I'm not literate enough in this stuff to know what it means.

Sep 20 09:27:03 Lynxegon polkitd(authority=local): Operator of unix-session:c1 FAILED to authenticate to gain authorization for action org.nemo.root for unix-process:3530:2757 [nemo -n] (owned by unix-user:mechacow)
Sep 20 09:27:03 Lynxegon pkexec[10286]: mechacow: Error executing command as another user: Request dismissed [USER=root] [TTY=unknown] [CWD=/home/mechacow] [COMMAND=/usr/bin/nemo /home/mechacow/Desktop]
Sep 20 09:33:56 Lynxegon polkitd(authority=local): Operator of unix-session:c1 successfully authenticated as unix-user:mechacow to gain TEMPORARY authorization for action org.freedesktop.udisks2.open-device for system-bus-name::1.2366 [/usr/bin/gnome-disks --gapplication-service] (owned by unix-user:mechacow)
Sep 20 09:48:43 Lynxegon cinnamon-screensaver-dialog: gkr-pam: unlocked login keyring
Sep 20 09:48:56 Lynxegon gnome-screensaver-dialog: gkr-pam: unlocked login keyring

I'm assuming the last two lines are just me coming back to my computer and logging in from my lock screen, but that was the first time I could find an instance of me having to log in to both the cinnamon lock screen and what I'm assuming is the default gnome lock screen. Since then my lock screen has been behaving bizarrely, sometimes making me log in from two lock screens in a row. I just assumed it was some glitch from using cinnamon on Ubuntu (I've already seen and fixed a lot of them), but now I'm not sure if they are related.

Does anybody have any ideas about what might have occurred here?

EDIT: My syslog doesn't contain anything prior to me logging in this morning at 7:35am

  • 3
    "My syslog doesn't contain anything prior to me logging in this morning at 7:35am" Something has wiped your syslog? That is very suspicious. I would assume you have been hacked. Reinstall from scratch. – DavidPostill Sep 21 '16 at 12:58
  • How long does the syslog usually go back? – SuperMechaCow Sep 21 '16 at 13:18
  • That depends on how it is configured ... and that depends on the linux flavour – DavidPostill Sep 21 '16 at 13:22
  • If I was hacked, I would need to know how to prevent it in the future – SuperMechaCow Sep 21 '16 at 13:27
  • That is outside of my expertise. – DavidPostill Sep 21 '16 at 13:29
1

栯浯⽥敭档捡睯ⸯ慣档⽥敷止瑩椯潣摮瑡扡獡e is a case of character set mixup – more specifically, a Unicode encoding mixup. A program held the file name as UTF-8 [or ASCII, for that matter], but at some point thought that it had UTF-16 and converted the name again to UTF-8.

If you undo that (by converting the text from UTF-8 – e.g. with the iconv tool), you get the path /home/mechacow/.cache/webkit/icondatabase, which seems like something a browser would use.


Sep 20 09:27:03 Lynxegon polkitd(authority=local): Operator of unix-session:c1 FAILED to authenticate to gain authorization for action org.nemo.root for unix-process:3530:2757 [nemo -n] (owned by unix-user:mechacow)

Sep 20 09:27:03 Lynxegon pkexec[10286]: mechacow: Error executing command as another user: Request dismissed [USER=root] [TTY=unknown] [CWD=/home/mechacow] [COMMAND=/usr/bin/nemo /home/mechacow/Desktop]

This one says that someone tried to use the "Open as Root" option in the file manager, received the admin password prompt, but cancelled it.

Sep 20 09:33:56 Lynxegon polkitd(authority=local): Operator of unix-session:c1 successfully authenticated as unix-user:mechacow to gain TEMPORARY authorization for action org.freedesktop.udisks2.open-device for system-bus-name::1.2366 [/usr/bin/gnome-disks --gapplication-service] (owned by unix-user:mechacow)

This says that someone tried to use the "Create disk image" or "Restore from disk image" function in GNOME Disk Utility, and successfully provided the admin password.

Sep 20 09:48:43 Lynxegon cinnamon-screensaver-dialog: gkr-pam: unlocked login keyring

Sep 20 09:48:56 Lynxegon gnome-screensaver-dialog: gkr-pam: unlocked login keyring

This says that you do in fact have two "screensaver" programs running. Try uninstalling one, or at least disabling it from gnome-session-properties or similar tool.

| improve this answer | |
  • Amazing! Looking back on everything I did that day and what you're saying now it all makes sense. I was doing a lot of things I don't normally do and spooked myself when I didn't recognize the log entry. – SuperMechaCow Sep 22 '16 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.