5.33. Unusual or hidden files

It is important to not forget to look everywhere on the system for unusual or hidden files -files that start with a period and are normally not shown by the ls command, as these can be used to hide tools and information password cracking programs, password files from other systems, etc.. A common technique on UNIX systems is to put a hidden directory or file in a user's account with an unusual name, something like '...' or '.. ' -dot dot space or ..-^G -dot dot ctrl-G. The find program can be used to look for hidden files.

            [root@deep] /# find / -name ".. " -print -xdev
            [root@deep] /# find / -name ".*" -print -xdev | cat -v
            

All SUID and SGID files that still exist on your system after we have removed those that won't absolutely require such privilege are a potential security risk, and should be monitored closely. Because these programs grant special privileges to the user who is executing them, it is necessary to ensure that insecure programs are not installed.

A favorite trick of crackers is to exploit SUID root programs, and leave a SUID program as a backdoor to get in the next time. Find all SUID and SGID programs on your system, and keep track of what they are so that you are aware of any changes, which could indicate a potential intruder. Use the following command to find all SUID/SGID programs on your system:

            [root@deep] /# find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \;
            

Group and world writable files and directories particularly system files partitions, can be a security hole if a cracker gains access to your system and modifies them. Additionally, world-writable directories are dangerous, since they allow a cracker to add or delete files as he or she wishes in these directories. In the normal course of operation, several files will be writable, including some from the /dev, /var/catman directories, and all symbolic links on your system. To locate all group & world-writable files on your system, use the command:

            [root@deep] /# find / -type f \( -perm -2 -o -perm -20 \) -exec ls -lg {} \;
            

            [root@deep] /# find / -type d \( -perm -2 -o -perm -20 \) -exec ls -ldg {} \;
            

Don't permit any unowned file. Unowned files may also be an indication that an intruder has accessed your system. If you find unowned file or directory on your system, verify its integrity, and if all looks fine, give it an owner name. Some time you may uninstall a program and get an unowned file or directory related to this software; in this case you can remove the file or directory safely. To locate files on your system that do not have an owner, use the following command:

            [root@deep] /#find / -nouser -o -nogroup
            

Finding all the .rhosts files that could exist on your server should be a part of your regular system administration duties, as these files should not be permitted on your system. Remember that a cracker only needs one insecure account to potentially gain access to your entire network. You can locate all .rhosts files on your system with the following command:

            [root@deep] /#find /home -name .rhosts
            

To use a cron job to periodically check and report via mail all .rhosts files, do the following: Create as root the find_rhosts_files script file under /etc/cron.daily directory touch /etc/cron.daily/find_rhosts_files and add the following lines in this script file:

            #!/bin/sh
            /usr/bin/find /home -name .rhosts | (cat <<EOF
            This is an automated report of possible existent .rhosts files on the server
            deep.openna.com, generated by the find utility command.

            New detected .rhosts files under the /home directory include:
            EOF
            cat
            ) | /bin/mail -s "Content of .rhosts file audit report" root
            

            [root@deep] /#chmod 755 /etc/cron.daily/find_rhosts_files
            [root@deep] /#chown 0.0 /etc/cron.daily/find_rhosts_files