10

The following lines appear in my CentOS secure log file:

Oct 27 21:10:59 servr userdel[7270]: delete user 'nagent'
Oct 27 21:10:59 servr userdel[7270]: removed group 'nagent' owned by 'nagent'
Oct 27 21:11:04 servr useradd[7333]: new group: name=nagent, GID=502
Oct 27 21:11:04 servr useradd[7333]: new user: name=nagent, UID=502, GID=502, home=/home/nagent, shell=/bin/bash

I did not do this, and I am the only one to my knowledge that has access to this server.

What do these log entries mean? Is there a process that might do this, or has someone else broken into my system?

Edit 1 - Running suggestions:

find / -user nagent -iname "*" -exec ls -l {} \;
-rw-rw----. 1 nagent mail 0 Oct 27 21:11 /var/spool/mail/nagent
find: `/proc/14041/task/14041/fd/5': No such file or directory
find: `/proc/14041/task/14041/fdinfo/5': No such file or directory
find: `/proc/14041/fd/5': No such file or directory
find: `/proc/14041/fdinfo/5': No such file or directory
total 28
drwx------. 2 root root 4096 Oct 27 21:11 CMData
drwx------. 2 root root 4096 Oct 27 21:11 CMSetting
-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf
-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf.Save
-rwxr-xr-x. 1 root root 5510 Oct 27 21:11 nagent_download.sh
-rwxr-xr-x. 1 root root 1665 Oct 27 21:11 uninstall.sh
-rw-r--r--. 1 nagent nagent 18 Sep 22 12:40 /home/nagent/.bash_logout
total 0
-rw-r--r--. 1 nagent nagent 124 Sep 22 12:40 /home/nagent/.bashrc
-rw-r--r--. 1 nagent nagent 176 Sep 22 12:40 /home/nagent/.bash_profile
total 8
drwxr-xr-x. 2 nagent nagent 4096 Aug 18  2010 extensions
drwxr-xr-x. 2 nagent nagent 4096 Aug 18  2010 plugins
total 0
total 0

I am not sure how to interpret this output...? Is this part of SendMail, I believe it might be? Googling SendMail "nagent" returns results discussing SendMail Network Agent. Not certain on this though. I am running SendMail SMTP server.

Edit 2 - contents of /etc/nagent.conf

[main]
    logfilename=/var/log/n-central/nagent.log
    loglevel=2
    homedir=/home/nagent/
    thread_limitation=50
    poll_delay=1
    datablock_size=20

[soap]
    Server=127.0.0.1
    Port=80
    Protocol=http
    ApplianceID=1
    Server_ro=no

FYI - port 80 is blocked on this server with the iptables entry:

-A INPUT -p tcp -m tcp --dport 80 -j DROP

The contents of /home/ncm/nable/nagent-rhel5.1_64/nagent_download.sh:

#!/bin/bash

# Exit on failure --------------------------------------------------------------
function exitOnFailure {
        echo "" >> $LOGGER
        echo "Download failed" >> $LOGGER
        echo "==================================== END DOWNLOAD ================================" >> $LOGGER
        exit 1
}

# Show usage -------------------------------------------------------------------
function usage {
        echo "" >> $LOGGER
        echo "Usage: nagent_download.sh URL InstallerName FileSize MD5Sum Destination [Proxy] [ProxyUsername] [ProxyPassword]" >> $LOGGER
        echo "Example: nagent_download.sh http://192.168.20.128/download/100.0.0.0/rhel5.1_64/N-central/nagent-rhel5.1_64.tar.gz nagent-rhel5.1.tar.gz 2785964 aea43c12d2a86d76ea95bbbf0bf625e9 /tmp" >> $LOGGER

        exitOnFailure
}

# Verify given arguments -------------------------------------------------------
function verifyArguments {
        if [ -z "$URL" ]
        then
                echo "No download url provided" >> $LOGGER
                usage
        fi

        if [ -z "$INSTALLER" ]
        then
                echo "No installer name provided" >> $LOGGER
                usage
        fi

        if [ -z "$INSTALLER_FILESIZE" ]
"/home/ncm/nable/nagent-rhel5.1_64/nagent_download.sh" 167L, 5335C

Edit 3

netstat -antp | grep 80
tcp        0      0 0.0.0.0:57808               0.0.0.0:*                   LISTEN      2190/rpc.statd      
tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      2027/java           
tcp        0      0 :::8009                     :::*                        LISTEN      2027/java           
tcp        0      0 :::80                       :::*                        LISTEN      2027/java           
tcp        0      0 ::ffff:127.0.0.1:58580      ::ffff:127.0.0.1:3306       TIME_WAIT   -                   
tcp        0      0 ::ffff:127.0.0.1:58380      ::ffff:127.0.0.1:3306       TIME_WAIT   -                   
tcp        0      0 ::ffff:192.168.1.18:443     ::ffff:70.192.192.180:10757 ESTABLISHED 2027/java           
tcp        0      0 ::ffff:127.0.0.1:58280      ::ffff:127.0.0.1:3306       TIME_WAIT   -                   
tcp        0      0 ::ffff:127.0.0.1:58480      ::ffff:127.0.0.1:3306       TIME_WAIT   - 

Edit 4

The nagent folder in home was created with the secure log events. I don't know if that is significant:

drwx------.  6 nagent   nagent    4096 Oct 27 21:11 nagent

Also displaying running processes ps aux | less has these related results

...
root      7393  0.0  0.0 108432  1176 ?        S    Oct27   0:00 /bin/sh /etc/init.d/nagent start
root      7396  0.0  0.0 108164  1404 ?        S    Oct27   0:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; nagent -f /home/nagent/nagent.conf
root      7397  0.0  0.0 219960  7100 ?        Sl   Oct27   0:15 nagent -f /home/nagent/nagent.conf
...

migrated from security.stackexchange.com Oct 28 '15 at 14:48

This question came from our site for information security professionals.

  • @Begueradj - That is not my account. I think that it's a processes account, but I do not know. I am not by any measure a Linux admin. – Roy Hinkley Oct 28 '15 at 13:52
  • 1
    Some daemons will create accounts but generally only at installation time. – Neil Smithline Oct 28 '15 at 14:04
  • Ok, did you install/reinstall something on Oct 27 around 21:10? – user414649 Oct 28 '15 at 14:15
  • @Begueradj I changed some iptable rules and restarted, but I have not installed or uninstalled anything for some time now. – Roy Hinkley Oct 28 '15 at 14:17
  • 3
    the IP number 192.168.20.128 is not a part of the general WAN, it is a private IP number – ojs Oct 28 '15 at 15:45
3

You can begin by search if the user nagent is owner of files on your system:

find / -user nagent -iname "*" -exec ls -l {} \;

And you can look at if some process have been launched and not again stopped by this user:

ps -ef | grep nagent

In yours logs, you can look at the activity of your server around the 27 october 21:10, something like this:

cat /var/log/<your file> | grep "Oct 27 21:1"

EDIT 1: Some files has been modified/created during the same time of the userdel and useradd:

-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf
-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf.Save
-rwxr-xr-x. 1 root root 5510 Oct 27 21:11 nagent_download.sh
-rwxr-xr-x. 1 root root 1665 Oct 27 21:11 uninstall.sh

Can you read nagent.conf and nagent_download.sh ?


EDIT 2: Can you verify if you have a process which listen on the TCP port 80:

 netstat -antp | grep 80

Have you done a update/upgrade maybe the 27 oct 21h ?


EDIT 3:

From the netstat command, you have the port 80 opened by a process with PID of 2027:java. Moreover, this process opens the 8089 and the 443 which has a connection with a machine :

  ::ffff:192.168.1.18:443     ::ffff:70.192.192.180:10757 ESTABLISHED     2027/java

To have more infos, you can do ps -ef | grep 2027 and see details on the commands and the parent process of it.

From your ps command, you have a service named nagent in /etc/init.d/nagent

In conclusion, you or someone have installed the agent of the N-central software (the files and process match with the doc done by @ojs in his solution). Now, you must search who and how this software has been installed.

To know which package has been installed: ls -ltr /var/lib/dpkg/info/*.list

You can look the .bash_history in the home directory of the users of your server

  • Curious - find / -user naget -iname "*" -exec ls -l {} \; find: `naget' is not the name of a known user – Roy Hinkley Oct 28 '15 at 14:42
  • sorry, a error of my part, I edited my answer, you can read nagent and not naget :) – Sorcha Oct 28 '15 at 14:44
  • I added Edit 1 in the answer – Sorcha Oct 28 '15 at 15:08
  • I updated my post. – Roy Hinkley Oct 28 '15 at 15:16
  • I added Edit 2 in the answer – Sorcha Oct 28 '15 at 15:44
2

This seems to point to product by Solarwinds N-able. At least they used to use /home/nagent and their packages were named nagent-rhel. I found reference to this in an old document from them.

1

Did you install Neptune?

nagent might be the user for the Neptune agent, added automatically when you install the package. By default the user is neptuneioagent, but your distro might have changed the user name.

  • No - I don't know what that is. – Roy Hinkley Oct 28 '15 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.