surreptitious modifications to /etc/passwd - extremely bizarre

jax_the_dog · 2019-10-11 04:03:32

ok, first of all, I'm posting to newbie because, although I've used linux since Redhat in the late 1990s, I only use it well enough to get what I need done. I use linux instances at work as a end user - I don't call myself a sysadmin although there have been times I have shown a trick or two to the operations guys. I've debugged plenty of hard problems over the years, but still wouldn't call myself a 'linux expert' at all. Also after mostly being on Centos and Debian, I only started using arch about a month ago. So I'm a newbie to that.

I was planning to migrate my main music (mpd) server from centos to arch. Was getting tired of certain issues in centos-land...besides my instance was REALLY old and had been through a couple 'unsupported' upgrades. It could be flaky at times.

I installed 4.19.69-1-lts a month ago. Wasn't able to get back to building the multimedia stack (ffmpeg, mpd, was going to do xfce tomorrow) until tonight. The machine was turned off for this month, not sitting there attached to the internet.

I had disabled remote root login, but not the account itself. I had also created a backup account with root access. So my normal protocol since forever is to ssh in from my windoze machine, su to root when necessary, and do root tasks. I only log in for administration. Most of the time the machine is a smb file server and mpd music server.

At some point in the process of preparing to build mpd tonight...an absolutely bizarre thing happened. I rebooted, logged in, and could not su to root as I usually do.

My /etc/passwd was modified so that the first line has an apostrophe ' in front of root. The "old" non-apostrophe root, was set to /nologin, and besides not 0 anymore, so no admin power. The net result of this was I could not su to root. I would have had to do some kind of password recovery if it had not been for the backup account that I gave root authority. When I google for anything about "automatic modification of /etc/passwd" "apostrophe in front of root", etc. etc. I find absolutely NOTHING. (when logged in as my backup account, "whoami" of course shows "'root", since the apostrophe version is now the one at the head of the file with a 0.)

A curious thing that happened earlier tonight, when installing some prerequisites, is that pacman gave a bunch of errors about not being able to find libogg-1.3.3.3-x86_64.pkg.tar.xz when I was installing alsa. I ran the command to refresh the database, and it seemed normal. But this is odd because that instance of pacman had installed things just fine a month ago...do the mirrors change that frequently? But I'm not even sure that's related. It seems more likely that one of the programs I had to compile as a pre-req for MPD, had been compromised on the web. And yes, I was building them with root, probably a bad idea, so the scripts could have done anything to my system. I'm particularly wondering about libmikmod, which was fairly recently moved to git.

Needless to say unless someone says this isn't something to worry about (I can still edit /etc/passwd with my backup root) I am going to assume the whole instance is now compromised, and, dagnabbit, have to rebuild it from scratch.

going away for a trip this weekend, so might not read responses until next week.

Last edited by jax_the_dog (2019-10-11 04:25:40)

fukawi2 · 2019-10-11 04:26:09

jax_the_dog wrote:

pacman had installed things just fine a month ago...do the mirrors change that frequently?

Yes. Arch is rolling release. The packages (and the mirrors) are updated multiple times per day.

jax_the_dog wrote:

And yes, I was building them with root, probably a bad idea, so the scripts could have done anything to my system.

Were you using PKGBUILD's, or just compiling random code from source? Did you take note of the modification time on /etc/passwd to narrow down when this change could have occurred?

jax_the_dog · 2019-10-11 04:34:54

fukawi2 wrote:

[ Did you take note of the modification time on /etc/passwd to narrow down when this change could have occurred?

Well, if I'd been in a better state of situational awareness - I would have done this! Unfortunately my first instinct was to try to 'fix' it.

I at least have all of the source code I compiled/installed, so now, when I have time, planning to grep that for stuff that looks suspicious.

__________________

btw I understand that the files would change more frequently with rolling release, but this was like 20-30 mirrors failing JUST FOR ONE file...rather odd? I never saw things like that with centos. But if this is a situation of something being compromised, I highly doubt it's related to that anyhow.

Before I sign off for tonight, I did copy the exact msg to a txt file: failed retrieving file 'libogg-1.3.3-3-x86_64.pkg.tar.xz'

Last edited by jax_the_dog (2019-10-11 04:41:45)

fukawi2 · 2019-10-11 04:41:53

jax_the_dog wrote:

btw I understand that the files would change more frequently with rolling release, but this was like 20-30 mirrors failing JUST FOR ONE file...rather odd? I never saw things like that with centos.

If that package had been updated in the month since you last updated, then totally normal. Old packages are not kept in the repo unlike other distros like CentOS. For example, CentOS 6 currently has 15 different releases/versions of the Firefox package in 6/updates/x86_64/Packages/, whereas Arch will only ever have the most recent version/release of any given package.

EDIT: libogg was last updated, 01-Sep-2019 16:09 so if your last update was prior to that, then your local pacman cache will have been looking for the previous version.

jax_the_dog · 2019-10-11 11:38:16

fukawi2, ok great, thanks for that key clarification. That totally makes sense because it was 27th of Aug I had last done anything on the server...though I booted it a couple times after than until the energy to continue the work fizzled out LOL. I guess the other thing that is slightly confusing is that it *seems* apt-get and yum refresh their DB as a part of every update process, whilst for pacman I had to run a separate command. I will certainly remember that in the future.

I got up earlier than I expected to leave and catch my flight so I had time to post one more time until Sunday night. What is so interesting to me is nobody has hopped on yet, saying this is nothing to worry about. I texted a young guy I worked with a couple years ago, he actually probably knows less about various aspects of linux history, multimedia configuration, etc. etc, than I, but he has been a paid sysadmin on linux and solaris systems. He was probably in a bar or something but his quick response to a couple long texts described my situation was "sounds like you were hacked cuz I never heard of that".

Here are a couple more strange things going on: ALL logins started taking 25 seconds, with strange messages in syslog like:
dbus-daemon[327]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out (service_start_timeout=25000ms)

dbus-daemon[327]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out (service_start_timeout=25000ms)

HOWEVER, when I booted it up this morning, something even more odd happened. It refused to even let me get to the password part of the login prompt after logging in, it seemed to freeze right after I had entered my alternative root ID. Then the terminal screen appeared to go back to a boot sequence, quickly flashing:
stopped getty on tty1
started getty on tty

Then a new login appeared. Now, no 25 second delay on tty, BUT it persisted over ssh!!!! Then I walk back to machine to try one more time: SUBSEQUENT logins on tty had the delay! NEVER seen anything like that in 20 years of playing around with Linux! Maybe 5 years ago something did happen with Centos causing globally delayed logins...cannot remember how I fixed it.

____________________________

Anyhow I started the machine this morning to visit my builds directory. Here is everything I compiled, you can see how some are "normal" root, some are "hacked" root:

['root@XXXXXXXXXX BUILDS]# ls -rot
total 23496
-rw-r--r--  1 'root 12083200 Oct  9  2016 libsamplerate-0.1.9.tar
-rw-r--r--  1 'root  6031360 Apr  2  2017 libsndfile-1.0.28.tar
drwxr-xr-x  2 root      4096 Jan 21  2018 chromaprint-fpcalc-1.4.3-linux-x86_64
-rw-r--r--  1 'root  5171200 Jan 21  2018 chromaprint-fpcalc-1.4.3-linux-x86_64.tar
-rw-r--r--  1 'root    60480 Oct  9  2018 libmpdclient-2.16.tar.xz
-rw-r--r--  1 'root   673056 Sep 25 19:25 mpd-0.21.15.tar.xz
drwxr-xr-x 15  1000     4096 Oct  5 14:54 libsndfile-1.0.28
drwxr-xr-x  9  1000     4096 Oct  5 14:56 libsamplerate-0.1.9
-rw-r--r--  1 'root     1352 Oct  5 15:07 wget-log
drwxr-xr-x  5 'root     4096 Oct  5 15:10 mikmod-mikmod
drwxrwxr-x  9 root      4096 Oct  5 16:01 libmpdclient-2.16
drwxr-xr-x  3 'root     4096 Oct  5 16:08 chromaprint
drwxrwxr-x 12 root      4096 Oct  5 16:10 mpd-0.21.15

And here are all packages installed - of course most of these were dependencies:


['root@XXXXXXX root]#  expac --timefmt='%Y-%m-%d %T' '%l\t%n' | sort | tail -n 500
2019-08-26 16:21:36     filesystem
2019-08-26 16:21:36     iana-etc
2019-08-26 16:21:36     linux-api-headers
2019-08-26 16:21:36     tzdata
2019-08-26 16:21:37     glibc
2019-08-26 16:21:40     bash
2019-08-26 16:21:40     bzip2
2019-08-26 16:21:40     gcc-libs
2019-08-26 16:21:40     ncurses
2019-08-26 16:21:40     readline
2019-08-26 16:21:41     acl
2019-08-26 16:21:41     attr
2019-08-26 16:21:41     db
2019-08-26 16:21:41     gdbm
2019-08-26 16:21:41     gmp
2019-08-26 16:21:41     libcap
2019-08-26 16:21:42     perl
2019-08-26 16:21:43     coreutils
2019-08-26 16:21:43     libgcrypt
2019-08-26 16:21:43     libgpg-error
2019-08-26 16:21:43     lz4
2019-08-26 16:21:43     openssl
2019-08-26 16:21:43     systemd-libs
2019-08-26 16:21:43     xz
2019-08-26 16:21:44     argon2
2019-08-26 16:21:44     audit
2019-08-26 16:21:44     cracklib
2019-08-26 16:21:44     cryptsetup
2019-08-26 16:21:44     dbus
2019-08-26 16:21:44     device-mapper
2019-08-26 16:21:44     e2fsprogs
2019-08-26 16:21:44     expat
2019-08-26 16:21:44     iptables
2019-08-26 16:21:44     json-c
2019-08-26 16:21:44     keyutils
2019-08-26 16:21:44     krb5
2019-08-26 16:21:44     libcap-ng
2019-08-26 16:21:44     libldap
2019-08-26 16:21:44     libmnl
2019-08-26 16:21:44     libnetfilter_conntrack
2019-08-26 16:21:44     libnfnetlink
2019-08-26 16:21:44     libnftnl
2019-08-26 16:21:44     libnl
2019-08-26 16:21:44     libpcap
2019-08-26 16:21:44     libsasl
2019-08-26 16:21:44     libtirpc
2019-08-26 16:21:44     libusb
2019-08-26 16:21:44     libutil-linux
2019-08-26 16:21:44     pam
2019-08-26 16:21:44     pambase
2019-08-26 16:21:44     popt
2019-08-26 16:21:44     zlib
2019-08-26 16:21:45     hwids
2019-08-26 16:21:45     kbd
2019-08-26 16:21:45     kmod
2019-08-26 16:21:45     libelf
2019-08-26 16:21:45     libidn2
2019-08-26 16:21:45     libseccomp
2019-08-26 16:21:45     libunistring
2019-08-26 16:21:45     pcre2
2019-08-26 16:21:45     shadow
2019-08-26 16:21:45     util-linux
2019-08-26 16:21:46     dhcpcd
2019-08-26 16:21:46     diffutils
2019-08-26 16:21:46     file
2019-08-26 16:21:46     findutils
2019-08-26 16:21:46     systemd
2019-08-26 16:21:47     gawk
2019-08-26 16:21:47     glib2
2019-08-26 16:21:47     libffi
2019-08-26 16:21:47     mpfr
2019-08-26 16:21:47     pcre
2019-08-26 16:21:48     gettext
2019-08-26 16:21:48     grep
2019-08-26 16:21:48     icu
2019-08-26 16:21:48     less
2019-08-26 16:21:48     libcroco
2019-08-26 16:21:48     libxml2
2019-08-26 16:21:49     gzip
2019-08-26 16:21:49     inetutils
2019-08-26 16:21:49     iproute2
2019-08-26 16:21:49     iputils
2019-08-26 16:21:49     jfsutils
2019-08-26 16:21:49     licenses
2019-08-26 16:21:56     libarchive
2019-08-26 16:21:56     linux-firmware
2019-08-26 16:21:56     mkinitcpio
2019-08-26 16:21:56     mkinitcpio-busybox
2019-08-26 16:21:56     zstd
2019-08-26 16:22:02     groff
2019-08-26 16:22:02     libaio
2019-08-26 16:22:02     libpipeline
2019-08-26 16:22:02     logrotate
2019-08-26 16:22:02     lvm2
2019-08-26 16:22:02     man-db
2019-08-26 16:22:02     thin-provisioning-tools
2019-08-26 16:22:03     ca-certificates-utils
2019-08-26 16:22:03     libtasn1
2019-08-26 16:22:03     man-pages
2019-08-26 16:22:03     mdadm
2019-08-26 16:22:03     nano
2019-08-26 16:22:03     netctl
2019-08-26 16:22:03     openresolv
2019-08-26 16:22:03     p11-kit
2019-08-26 16:22:04     ca-certificates
2019-08-26 16:22:04     ca-certificates-mozilla
2019-08-26 16:22:04     curl
2019-08-26 16:22:04     gnutls
2019-08-26 16:22:04     libassuan
2019-08-26 16:22:04     libksba
2019-08-26 16:22:04     libnghttp2
2019-08-26 16:22:04     libpsl
2019-08-26 16:22:04     libsecret
2019-08-26 16:22:04     libssh2
2019-08-26 16:22:04     nettle
2019-08-26 16:22:04     npth
2019-08-26 16:22:04     pinentry
2019-08-26 16:22:04     sqlite
2019-08-26 16:22:05     archlinux-keyring
2019-08-26 16:22:05     gnupg
2019-08-26 16:22:05     gpgme
2019-08-26 16:22:05     pacman
2019-08-26 16:22:05     pacman-mirrorlist
2019-08-26 16:22:05     pciutils
2019-08-26 16:22:05     procps-ng
2019-08-26 16:22:05     psmisc
2019-08-26 16:22:05     reiserfsprogs
2019-08-26 16:22:05     sed
2019-08-26 16:22:05     s-nail
2019-08-26 16:22:05     sysfsutils
2019-08-26 16:22:05     systemd-sysvcompat
2019-08-26 16:22:05     tar
2019-08-26 16:22:05     texinfo
2019-08-26 16:22:05     usbutils
2019-08-26 16:22:05     vi
2019-08-26 16:22:05     which
2019-08-26 16:22:06     autoconf
2019-08-26 16:22:06     binutils
2019-08-26 16:22:06     bison
2019-08-26 16:22:06     fakeroot
2019-08-26 16:22:06     flex
2019-08-26 16:22:06     libmpc
2019-08-26 16:22:06     m4
2019-08-26 16:22:06     xfsprogs
2019-08-26 16:22:10     gc
2019-08-26 16:22:10     gcc
2019-08-26 16:22:10     libatomic_ops
2019-08-26 16:22:10     libtool
2019-08-26 16:22:11     guile
2019-08-26 16:22:11     make
2019-08-26 16:22:11     patch
2019-08-26 16:22:11     sudo
2019-08-26 16:30:12     grub
2019-08-26 17:02:20     dnssec-anchors
2019-08-26 17:02:20     ldns
2019-08-26 17:02:20     libedit
2019-08-26 17:02:20     openssh
2019-08-27 08:15:33     linux-lts
2019-08-27 08:26:03     linux-lts-headers
2019-10-05 14:27:00     alsa-lib
2019-10-05 14:27:00     libogg
2019-10-05 14:27:01     alsa-oss
2019-10-05 14:27:01     alsa-utils
2019-10-05 14:27:01     fftw
2019-10-05 14:27:01     flac
2019-10-05 14:27:01     libsamplerate
2019-10-05 14:27:01     libsndfile
2019-10-05 14:27:01     libvorbis
2019-10-05 14:28:23     wget
2019-10-05 14:30:15     libnsl
2019-10-05 14:30:19     python
2019-10-05 14:37:22     python-appdirs
2019-10-05 14:37:22     python-cachecontrol
2019-10-05 14:37:22     python-chardet
2019-10-05 14:37:22     python-colorama
2019-10-05 14:37:22     python-distlib
2019-10-05 14:37:22     python-distro
2019-10-05 14:37:22     python-html5lib
2019-10-05 14:37:22     python-idna
2019-10-05 14:37:22     python-importlib-metadata
2019-10-05 14:37:22     python-lockfile
2019-10-05 14:37:22     python-more-itertools
2019-10-05 14:37:22     python-msgpack
2019-10-05 14:37:22     python-packaging
2019-10-05 14:37:22     python-pep517
2019-10-05 14:37:22     python-pip
2019-10-05 14:37:22     python-progress
2019-10-05 14:37:22     python-pyparsing
2019-10-05 14:37:22     python-pytoml
2019-10-05 14:37:22     python-requests
2019-10-05 14:37:22     python-retrying
2019-10-05 14:37:22     python-setuptools
2019-10-05 14:37:22     python-six
2019-10-05 14:37:22     python-urllib3
2019-10-05 14:37:22     python-webencodings
2019-10-05 14:37:22     python-zipp
2019-10-05 14:38:22     ninja
2019-10-05 14:40:15     boost-libs
2019-10-05 14:40:17     boost
2019-10-05 14:40:28     pkgconf
2019-10-05 14:47:18     aom
2019-10-05 14:47:18     fontconfig
2019-10-05 14:47:18     freetype2
2019-10-05 14:47:18     fribidi
2019-10-05 14:47:18     graphite
2019-10-05 14:47:18     gsm
2019-10-05 14:47:18     harfbuzz
2019-10-05 14:47:18     jack
2019-10-05 14:47:18     lame
2019-10-05 14:47:18     libass
2019-10-05 14:47:18     libavc1394
2019-10-05 14:47:18     libbluray
2019-10-05 14:47:18     libpng
2019-10-05 14:47:18     libraw1394
2019-10-05 14:47:18     libxau
2019-10-05 14:47:18     libxdmcp
2019-10-05 14:47:18     xcb-proto
2019-10-05 14:47:18     xorgproto
2019-10-05 14:47:18     zita-alsa-pcmi
2019-10-05 14:47:18     zita-resampler
2019-10-05 14:47:19     libdrm
2019-10-05 14:47:19     libomxil-bellagio
2019-10-05 14:47:19     libpciaccess
2019-10-05 14:47:19     libunwind
2019-10-05 14:47:19     libx11
2019-10-05 14:47:19     libxcb
2019-10-05 14:47:19     libxdamage
2019-10-05 14:47:19     libxext
2019-10-05 14:47:19     libxfixes
2019-10-05 14:47:19     libxrender
2019-10-05 14:47:19     libxshmfence
2019-10-05 14:47:19     libxxf86vm
2019-10-05 14:47:19     wayland
2019-10-05 14:47:21     llvm-libs
2019-10-05 14:47:21     lm_sensors
2019-10-05 14:47:23     libglvnd
2019-10-05 14:47:23     libxcursor
2019-10-05 14:47:23     mesa
2019-10-05 14:47:24     glslang
2019-10-05 14:47:24     lcms2
2019-10-05 14:47:24     libibus
2019-10-05 14:47:24     libjpeg-turbo
2019-10-05 14:47:24     libtiff
2019-10-05 14:47:24     sdl2
2019-10-05 14:47:24     shaderc
2019-10-05 14:47:24     spirv-tools
2019-10-05 14:47:24     vulkan-icd-loader
2019-10-05 14:47:25     dav1d
2019-10-05 14:47:25     giflib
2019-10-05 14:47:25     libasyncns
2019-10-05 14:47:25     libice
2019-10-05 14:47:25     libiec61883
2019-10-05 14:47:25     libmodplug
2019-10-05 14:47:25     libplacebo
2019-10-05 14:47:25     libpulse
2019-10-05 14:47:25     libsm
2019-10-05 14:47:25     libsoxr
2019-10-05 14:47:25     libssh
2019-10-05 14:47:25     libtheora
2019-10-05 14:47:25     libva
2019-10-05 14:47:25     libvdpau
2019-10-05 14:47:25     libvpx
2019-10-05 14:47:25     libwebp
2019-10-05 14:47:25     libxi
2019-10-05 14:47:25     libxtst
2019-10-05 14:47:25     libxv
2019-10-05 14:47:25     l-smash
2019-10-05 14:47:25     opencore-amr
2019-10-05 14:47:25     openjpeg2
2019-10-05 14:47:25     opus
2019-10-05 14:47:25     vid.stab
2019-10-05 14:47:25     x264
2019-10-05 14:47:25     x265
2019-10-05 14:47:25     xvidcore
2019-10-05 14:47:26     hicolor-icon-theme
2019-10-05 14:47:26     speex
2019-10-05 14:47:26     speexdsp
2019-10-05 14:47:26     v4l-utils
2019-10-05 14:47:27     ffmpeg
2019-10-05 15:04:17     faad2
2019-10-05 15:09:56     perl-error
2019-10-05 15:09:56     perl-mailtools
2019-10-05 15:09:56     perl-timedate
2019-10-05 15:09:57     git
2019-10-05 15:22:24     automake
2019-10-05 15:33:47     jsoncpp
2019-10-05 15:33:47     libuv
2019-10-05 15:33:47     rhash
2019-10-05 15:33:47     shared-mime-info
2019-10-05 15:33:48     cmake
2019-10-05 15:42:32     libmad
2019-10-05 15:46:25     fluidsynth
2019-10-05 15:46:25     portaudio
2019-10-05 15:49:46     wavpack
2019-10-05 15:51:30     audiofile
2019-10-05 15:52:39     libshout
2019-10-05 16:03:22     libupnp
2019-10-05 16:04:07     libmpcdec
2019-10-05 16:04:33     openal
2019-10-05 16:04:48     zziplib
2019-10-05 16:05:00     libmms
2019-10-05 16:12:48     tcsh
2019-10-05 16:15:43     libcddb
2019-10-05 16:15:43     libcdio
2019-10-05 16:15:43     libcdio-paranoia
2019-10-05 16:16:45     libid3tag
2019-10-05 17:21:13     expac

Last edited by jax_the_dog (2019-10-11 12:01:34)

jax_the_dog · 2019-10-11 11:50:08

OMG, another odd thing I noticed:
['root@XXXXXXXXXX BUILDS]# cat /etc/passwd | grep 1000
['root@XXXXXXXXXX BUILDS]#

I have NEVER removed a user on this system? WTF? why are 2 of those directories owned by 1000?
EDIT: just realized, I mispelled my first personal name acct, and quickly removed it. But that was back in August. I didn't CREATE the builds folder until last night! So it is still very odd! the 2 personal named accounts have numbers 1001 and 1002 as expected.

Here is /etc/passwd with my alternative root ID removed, as well as my 2 personal-named accounts:

'root:x:0:0::/root:/bin/bash
bin:x:1:1::/:/usr/bin/nologin
daemon:x:2:2::/:/usr/bin/nologin
mail:x:8:12::/var/spool/mail:/usr/bin/nologin
ftp:x:14:11::/srv/ftp:/usr/bin/nologin
http:x:33:33::/srv/http:/usr/bin/nologin
nobody:x:65534:65534:Nobody:/:/usr/bin/nologin
dbus:x:81:81:System Message Bus:/:/usr/bin/nologin
systemd-journal-remote:x:982:982:systemd Journal Remote:/:/usr/bin/nologin
systemd-network:x:981:981:systemd Network Management:/:/usr/bin/nologin
systemd-resolve:x:980:980:systemd Resolver:/:/usr/bin/nologin
systemd-timesync:x:979:979:systemd Time Synchronization:/:/usr/bin/nologin
systemd-coredump:x:978:978:systemd Core Dumper:/:/usr/bin/nologin
uuidd:x:68:68::/:/usr/bin/nologin
___
___
___
root:x:977:0:Super User:/root:/usr/bin/nologin
git:x:976:976:git daemon user:/:/usr/bin/git-shell
ntp:x:87:87:Network Time Protocol:/var/lib/ntp:/bin/false

Last edited by jax_the_dog (2019-10-11 12:01:01)

V1del · 2019-10-11 11:57:53

Please use [ code ] [ /code ] tags without the spaces for pasting outputs.

You might want to post/look through your the journal of the timeframe you noticed the modification, otherwise it'd be quite hard to make informed suggestions.

FWIW why exactly are you building those manually? Do you use some very specific compile options/flags? All of this is in the repo and I'd first use that and only start fumbling with manual builds if the package from the repository doesn't fit my needs for some reason (also in the case that a modification here is responsible, you might want to check your modifications made).

Last edited by V1del (2019-10-11 12:00:36)

jax_the_dog · 2019-10-11 12:08:52

Thanks for being responsive, unfortunately I gotta go. Now I realize, yes it was silly to compile those: I was coming from the centos background where mpd was either not in the repos or the version that was, was ancient and didn't play all formats I want to play - I recompiled it every once in a while keep it more updated! (well, last maybe 4-5 years ago!) When I rebuild the archlinux server I will be able to do everything from pacman. Yeah!

Last edited by jax_the_dog (2019-10-11 12:10:29)

fukawi2 · 2019-10-13 23:37:10

jax_the_dog wrote:

What is so interesting to me is nobody has hopped on yet, saying this is nothing to worry about. I texted a young guy I worked with a couple years ago, he actually probably knows less about various aspects of linux history, multimedia configuration, etc. etc, than I, but he has been a paid sysadmin on linux and solaris systems. He was probably in a bar or something but his quick response to a couple long texts described my situation was "sounds like you were hacked cuz I never heard of that".

What's more likely:
1) Your system (that was powered off for a large amount of time, had limited to no services listening for incoming connections, and I'm assuming is behind a NAT router/firewall anyway) got compromised by a malicious actor who almost immediately made it obvious they were there; or
2) A misbehaving compilation process borked some configuration files.
The rest of your posts are hard to follow, but I'd be putting my money on option 2.

Arch Linux

#1 2019-10-11 04:03:32

surreptitious modifications to /etc/passwd - extremely bizarre

#2 2019-10-11 04:26:09

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#3 2019-10-11 04:34:54

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#4 2019-10-11 04:41:53

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#5 2019-10-11 11:38:16

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#6 2019-10-11 11:50:08

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#7 2019-10-11 11:57:53

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#8 2019-10-11 12:08:52

Re: surreptitious modifications to /etc/passwd - extremely bizarre

#9 2019-10-13 23:37:10

Re: surreptitious modifications to /etc/passwd - extremely bizarre

Board footer