Re: [cobalt-security] Odd entries in passwd file?

[Dmitry Alexeyev <dmi_a@xxxxxxxxxx>]

> At the very bottom there is two users I havent seen before.. I know
> they look like services, but should they even be there?
>
> rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
> nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin

I don't see them in /etc/passwd
/sbin/nologin looks like it was some RPM package installed, maybe from 
redhat. 

>
>
> I removed them for the time being, not fully understanding why there
> are there to begin with.

one for Network File System, and one for Remote Procedure Calls. 
Not really sure you need those services... 

ssh listening at ports 81 and 444 means someone, maybe you, have set up 
port forwarding to have secure connection with admin interface. 

If you suspect your raq being hacked, do the following: 
1) download and install chkrootkit (form sources) http://chkrootkit.org; 
run it and check if it says something is infected;

2) check /tmp/ directory for some suspecious files 

3) check web.log for every site for commands like uname/wget being run 
with php/cgi scripts. 

Dmitry