[SOLVED] Asking about arch/linux security

ExoticCandy · 2021-07-24 21:47:00

I had no clue where to put this question, so I chose newbie corner just to be sure.

Well, around 10 minutes ago, while trying to run a sudo command, i failed my password 3 times (i can type it blind fold, but lets say i typed it wrong)
I had an urgent thing to do, so i went on tty1 to log in as root and unlock my account, typed my password letter by letter so i know im not doing anything wrong. failed, 3 times.
Definitely my passwords were changed.
I booted my installation media, mounted my root drive and changed my password there. (got no "The password has not been changed." warnings either, dont know if it shows up there or not, but anyway)

I am back on my pc, but i am clueless as to what could cause that password change without me being notified.

And nope, i have nothing specific running with root privileges. only the base softwares and things running by systemd, and in that session i only typed my passwords for "sudo pacman" commands.

What could be the cause of that incident? can anyone help me track this down please?

Last edited by ExoticCandy (2021-07-25 09:05:57)

jasonwryan · 2021-07-24 22:02:04

CapsLock.

ExoticCandy · 2021-07-24 22:36:53

Well, capslock is the most obvious thing one would check after typing password wrong two times and knowing the next time there will be a lock down. and i really checked that and it was off.

jasonwryan · 2021-07-24 23:05:02

Well, if it is not user error, then I would be checking the logs/journal to satisfy myself that the machine had not been compromised.

ExoticCandy · 2021-07-25 00:24:39

Well, as this line in my journal suggests, my caps was off for sure, cause otherwise i was typing ROOT, hence there were no way for my root account to be locked.

 Jul 25 01:45:09 EC login[51887]: pam_faillock(login:auth): Consecutive login failures for user root account temporarily locked

And this is DEFINITELY not me, cause i always use tty6 when i need a tty session, and DE is on tty2.

Jul 25 01:34:12 EC login[51836]: FAILED LOGIN SESSION FROM tty3 FOR root, Permission denied

And i found this before my attempts:

Jul 25 01:38:59 EC passwd[33281]: pam_unix(passwd:chauthtok): password changed for exoticcandy
Jul 25 01:38:59 EC audit[33281]: USER_CHAUTHTOK pid=33281 uid=1000 auid=1000 ses=4 subj==unconfined msg='op=PAM:chauthtok grantors=pam_unix acct="exoticcandy" exe="/usr/bin/passwd" hostname=EC addr=? terminal=pts/2 res=success'

As it seems my machine was compromised, as im totally sure it wasn't me changing the password at 1:38:59, and definitely it wasn't me using tty3 cause i never ever use that, i always use tty6 because it always was near tty7 (the default, old graphical tty) and im used to that one.

But im clueless on finding traces of how that has happened. i have a really strict firewalld setup which literally blocks every port that i didn't need. can you help me track this further down please?

Last edited by ExoticCandy (2021-07-25 00:25:37)

jasonwryan · 2021-07-25 00:58:44

Start with /etc/passwd: is there any user in there that shouldn't be. Look for open ports. See is any other files in /etc have been changed in the last x period of time.

# edit: changing your user's password doesn't sound like a smart compromise: it alerts you to something immediately. My money is still on something you did and forgot. Also packages in the official repos would ever change your password behind your back. Unless you missed this: https://archlinux.org/news/sorting-out- … rd-hashes/

Last edited by jasonwryan (2021-07-25 01:02:10)

ExoticCandy · 2021-07-25 01:45:30

the only weird things in /etc/passwd are these two:

cups:x:209:209:cups helper user:/:/usr/bin/nologin
flatpak:x:965:965:Flatpak system helper:/:/usr/bin/nologin

I know both are trusted packages, but im sure i didn't install any of those myself. pamac comes with flatpack support, so maybe i can cross out flatpak. but does gnome come with cups as dependency? i didn't see cups as the dependency on arch package list. and im sure i didn't install cups myself.

About the /etc folder, in my journal there is only references to these:

Jul 24 21:33:06 EC NetworkManager[420]: <info>  [1627146186.6835] Read config: /etc/NetworkManager/NetworkManager.conf (lib: 20-connectivity.conf)
Jul 24 21:33:07 EC polkitd[446]: Loading rules from directory /etc/polkit-1/rules.d
Jul 24 21:35:21 EC /usr/lib/gdm-x-session[873]: /etc/gdm/Xsession: Beginning session setup...
Jul 24 21:35:21 EC /usr/lib/gdm-x-session[873]: /etc/gdm/Xsession: Setup done, will execute: /usr/bin/gnome-session

Which are perfectly fine. (the only references to /etc where those 4 in my ~5 hours long session which my password changed in that session)
for ports, i only have 1714-1764 tpc & udp ports open, which i opened them manually for kde connect to work.

Well, I am working on my arch installer scripts, and a part of my scripts actually involve a shell script which sets both root and exactly "exoticcandy" user's password. and it is even executable, but i would need to run it as sudo anyway, cause first step is changing the root password.

The only time i typed my root password in that session that wasn't for pacman, was the time i was bored and installed oneko from aur using pamac. i rarely install anything from aur and only rely on official repo.

P.S. : I was using XanMod kernel in that session, and compilation takes me around 4.5 hours on this machine. last time i needed to update, i updated it from this custom repo: aur.andontie.net which is a signed repo, introduced in the arch wiki. https://wiki.archlinux.org/title/unoffi … dontie-aur
That is the most shady thing I have on my computer I would say. Can it be caused by that? like i understand kernel has full access to everything and injecting a line of code to kernel is too easy. but i didn't think such a repo would do something like that. that's why i trusted it in the first place

Edit: and yea, i missed that news you linked. but i was fine since then, can it still be caused by that?

Last edited by ExoticCandy (2021-07-25 01:48:18)

jasonwryan · 2021-07-25 01:51:32

ExoticCandy wrote:

I am working on my arch installer scripts, and a part of my scripts actually involve a shell script which sets both root and exactly "exoticcandy" user's password. and it is even executable, but i would need to run it as sudo anyway, cause first step is changing the root password.

This seems the most plausible explanation to me.

tucuxi · 2021-07-25 07:39:35

It wouldn't hurt to run rkhunter and see if it comes up with anything suspicious.

List of applications/Security

Last edited by tucuxi (2021-07-25 07:41:44)

ExoticCandy · 2021-07-25 09:05:39

From rkhunter, these were the ones i couldn't understand, like if those files are supposed to be there or not.

[13:11:40]   Checking for hidden files and directories       [ Warning ]
[13:11:40] Warning: Hidden file found: /etc/.updated: ASCII text
[13:11:40] Warning: Hidden file found: /usr/share/man/man5/.k5login.5.gz: gzip compressed data, max compression, from Unix, truncated
[13:11:40] Warning: Hidden file found: /usr/share/man/man5/.k5identity.5.gz: gzip compressed data, max compression, from Unix, truncated

Another warinng involved SSH being allowed, and I had no ssh activity in my journal log. so that's not the case either.

The more I dig deeper the more I start to suspect this as well:

jasonwryan wrote:

My money is still on something you did and forgot.

But im sure i didn't run that one script as root, or even as a normal user. since my install scripts always have self cleaning "rm $0" in the end (i save them again from IDE after running, or redownload from github) and that script is still there.
But yea, no ssh access, no rootkits, no modified files. it must have been an error on my side.

At least now I know it wasn't a hack or a malware. Thank you so much for helping me track this down! Much appreciated.

Last edited by ExoticCandy (2021-07-25 09:06:47)

Arch Linux

#1 2021-07-24 21:47:00

[SOLVED] Asking about arch/linux security

#2 2021-07-24 22:02:04

Re: [SOLVED] Asking about arch/linux security

#3 2021-07-24 22:36:53

Re: [SOLVED] Asking about arch/linux security

#4 2021-07-24 23:05:02

Re: [SOLVED] Asking about arch/linux security

#5 2021-07-25 00:24:39

Re: [SOLVED] Asking about arch/linux security

#6 2021-07-25 00:58:44

Re: [SOLVED] Asking about arch/linux security

#7 2021-07-25 01:45:30

Re: [SOLVED] Asking about arch/linux security

#8 2021-07-25 01:51:32

Re: [SOLVED] Asking about arch/linux security

#9 2021-07-25 07:39:35

Re: [SOLVED] Asking about arch/linux security

#10 2021-07-25 09:05:39

Re: [SOLVED] Asking about arch/linux security

Board footer