Strange ip has been on my server -what do I do?

Question

I'm basically a Newb,
I ran top yesterday and discovered /user/sbin/httpd was running in several instances started by a guest account.  I reviewed the auth.log and found long streams of login attempts with multiple different names. They finally discovered an account that was created without a password I forgot about.
I've removed that account, disabled my ssh port forward. Anything else I should do? Do I report this to the authorities? If so who?
How do I check and see what else they may have done?
Thanks
Tom

Answer 1

Socal Tom wrote:I'm basically a Newb,
Welcome to Arch Linux.
I ran top yesterday and discovered /user/sbin/httpd was running in several instances started by a guest account.  I reviewed the auth.log and found long streams of login attempts with multiple different names. They finally discovered an account that was created without a password I forgot about.
How is your machine attached to the Internet?  If you are behind a router on a private LAN, then you had to have opened ports and forwarded them to your machine.  One of those would have to have been port 44322 for ssh.  HTTP ports would have to be opened separately.  Does your router have a password when you access it from your LAN?  Is there a password set?  If so, an intruder would have a more difficult time making a http server accessible from the Internet.
Also, (This is important) Do you know the port numbers on which those servers were running?  I ask, because port numbers below 1024 require root access to open.  If an intruder was able to open a privileged port, then that intruder acquired root privileges and you should consider your system to be completely compromised.  Had that guest account, the one without a password, been a member of the 'wheel' group?   
I've removed that account, disabled my ssh port forward. Anything else I should do? Do I report this to the authorities? If so who?
No. No one is going to care about an intrusion into a home server.
How do I check and see what else they may have done?
You need to determine whether they obtained root privilege.  Positive evidence may exist in the logs.  Lack of evidence cannot be trusted as the data cold have been tampered. If the account was a member of 'wheel', I would not trust your system.  If you are sure they did not attain elevated privilege, you might be okay.  Knowing the port numbers would be helpful in making that determination.
If you have a router, audit it for open ports or DMZs.  Ensure that you know why and how each one is open.
Edit: Fixed port number for ssh.  I had given the port for https
Last edited by ewaller (2014-07-25 14:47:40)