E-mail Alert on Root SSH Login Published: Dec 08, 2003
  • Rating


Red Hat has released a new Errata Alert for the Kernel for Red Hat 9.

Advisory: RHSA-2004:065-05
Last updated on: 2004-02-18
Affected Products: Red Hat Linux 9


Updated kernel packages that fix security vulnerabilities which may allow
local users to gain root privileges are now available. These packages also
resolve other minor issues.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap() in the
Linux kernel versions 2.4.24 and previous that may allow a local attacker
to gain root privileges. No exploit is currently available; however this
issue is exploitable. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0077 to this issue.

The Vicam USB driver in kernel versions prior to 2.4.25 does not use the
copy_from_user function to access userspace, which crosses security
boundaries. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0075 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system to
mount volumes of NetWare servers or print to NetWare printers. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0010 to this issue.

Alan Cox found issues in the R128 Direct Render Infrastructure that could
allow local privilege escalation. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0003 to this issue.

All users are advised to upgrade to these errata packages, which contain
backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting the issue

Downloads and complete details:

  • Rating


Related Articles

Comments (16)

  • Gravatar - Edward
    Edward 07:05, December 9, 2003
    Loved it worked like a charm, but I had to make the entire code into one line instead of a 3 line code not sure why.
  • Gravatar - Chris
    Chris 22:34, December 19, 2003
    I am trying to do this but get a mail command not found when I login after doing this. cpanel/RH9

    Any ideas what I might be doing wrong?
  • Gravatar - C0NIk
    C0NIk 17:15, March 16, 2004
    it's cool one but sometime dont work with the Red Hat Entrprise 3

    so if it didnt work it will be easy to install LogWatch
  • Gravatar - Jimmy B Silva II
    Jimmy B Silva II 10:20, March 27, 2004
    Make sure you put in a single line like Edward did. It should work for Red Hat Enterprise 3
  • Gravatar - jad madi
    jad madi 15:46, May 20, 2004
    use echo -n for better
    so none will notice that there is a monitoring for login
  • Gravatar - JLChafardet
    JLChafardet 19:36, November 2, 2004
    It worked like charm on my RHEL ES3 box, will see if it sends mails every root try.<br />
    <br />
    any way it is most recomended that you forbid direct root logins.
  • Gravatar - Holoken
    Holoken 20:53, July 17, 2005
    If the attacker's clever then it won't work. Instead of logging in like Joe Admin would, he'll tell ssh to execute the following command: "ssh user@example.com /bin/bash --noprofile --norc". This'll bypass the mail-sending script in /root/.bashrc, and we'll be none the wiser.<br />
    <br />
    Put it instead in /root/.ssh/rc which is executed before any command (including any login shell) is run. This way the attacker's login will not go undetected even if he uses the above method to get in.<br />
  • Gravatar - Arif Kanji
    Arif Kanji 19:22, August 9, 2005
    Awesome!<br />
    How do u code to get alerts only for users who have entered incorrect username and/or password?<br />
    <br />
  • Gravatar - Clayton
    Clayton 21:40, October 23, 2005
    Hi,<br />
    I couldn't see .bashrc anywhere in my /root what should i do.<br />
    <br />
    Thanks<br />
    Regards,<br />
    CEO NightShells.NeT
  • Gravatar - BitSurFer
    BitSurFer 16:38, July 11, 2006
    somthing wrong!!<br />
    when i login i get this error<br />
    ----------------------------<br />
    cut: you must specify a list of bytes, characters, or fields<br />
    Try `cut --help' for more information.<br />
    -bash: -f1: command not found<br />
  • Gravatar - Dave
    Dave 16:55, March 15, 2007
    BitSurFer,<br />
    <br />
    Try replacing:<br />
    `who | cut -d"(" -f2 | cut -d")" -f1`<br />
    <br />
    with:<br />
    `whoami`<br />
    <br />
    It should do the same thing.<br />
  • Gravatar - JACOB
    JACOB 10:50, April 10, 2008
    I CAN'T SEE WHERE IT IS WRITTEN - "echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com" <br />
    <br />
  • Gravatar - Phil
    Phil 17:29, May 15, 2008
    For FreeBSD users, edit the /root/.cshrc file and add the line as follows:<br />
    <br />
    echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `whoami`" yourname@your.email<br />
    <br />
    This should all be one line and should probably be added to the end of the file.<br />
    <br />
  • Gravatar - Paul Brady
    Paul Brady 21:11, September 9, 2008
    I can only get this tip to work if I enter:<br />
    # source .bash_profile<br />
    <br />
    to source the file. When I do that, I get an email. When I log out, however, and then log back in (using su) I get no alert by email.<br />
    Am I missing something? I've been banging my head on the wall for hours. Can someone help? :-)<br />
  • Gravatar - ubaid
    ubaid 00:49, September 23, 2008
    can we add the IP address of the machine whom we login or just like the message we get when we login to root user
  • Gravatar - ericinwisconsin
    ericinwisconsin 15:59, July 1, 2009
    An elegant solution, yes, but also prevent root from logging in at all. Add this line:<br />
    <br />
    AllowUsers <i>username</i><br />
    <br />
    to your sshd_config file.<br />
    <br />
    For us Debian (and probably Ubuntu) users, the file it at /etc/ssh/sshd_config<br />
    <br />
    You can issue an "su" command to become root. I NEVER allow root direct ssh access to a box, but I do also use the technique on this page to make sure. I also limit ssh access only from certain other boxes on important servers and routers.<br />

Add Your Thoughts

WebHostGear.com is a hosting directory, not a web host.

Copyright © 1998-2018 WebHostGear.com