NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Concerned by the contents of ReadyNAS .bash_history file
I was looking at one of my NAS devices as admin and I noticed the .bash_history file in the admin home directory so I took a look. I'm concerned by what I see because I don't remember accessing the shell, nor would I would have tried to install rsyslog.
Is there a legitimate reason why I would be seeing this or should I be concerned someone other than me found their way into the NAS as admin?
apt-get install rsyslog susdo apt-get install rsyslog apt-get install rsyslog ls cd .. ls exit apt-get install rsyslog apt-get install rsyslog exit apt-get install rsyslog exit apt-get install rsyslog exit apt-key install rsyslog apt-get install rsyslog exit apt-get install rsyslog exit apt-get install rsyslog exit apt-get install rsyslog
6 Replies
Replies have been turned off for this discussion
iceweasel wrote:
I was looking at one of my NAS devices as admin and I noticed the .bash_history file in the admin home directory so I took a look.
FWIW, for most purposes it's best to log in as root (using the NAS admin password). So you probably should log in that way, and look at .bash_history there too.
iceweasel wrote:
Is there a legitimate reason why I would be seeing this or should I be concerned someone other than me found their way into the NAS as admin?
I think you should be worried (at least enough to follow up). Unfortunately, .bash_history doesn't timestamp the commands, so you don't know when they were issued.
Download the log zip file, and look in apt-history.log. Some of the stuff in there is done by the system, but you will see manually installed packages there also, and that is dated.
Thanks I'll follow those suggestions and look at the apt log as well as examine root account.
I downloaded the logs using the webportal. I think the majority of the apt-get history looks pretty straightforward and clean.
Several of the system updates looking commands. The first looks like primary install and several of the second which seem to be ready nas system updates:
Commandline: apt-get install -fy rn-dictionary freeapp-collection ca-certificates readynasos
Commandline: apt-get -qq install -fy rn-dictionary freeapp-collection ca-certificates readynasos
There's a freeapp removal back in 2017, minutes later there's the update show directly above:
Start-Date: 2017-11-01 20:31:24 Commandline: apt-get -y purge freeapp-collection Purge: freeapp-collection:armel (1507912757) End-Date: 2017-11-01 20:31:26
There's also a samba update in 2020
Commandline: apt-get -yq install --reinstall --allow-downgrades -o APT::Status-Fd=5 smbplus
But there's really nothing else and I see no reference to the rsyslog attempts found in the .bash_history file.
I couldn't find a .bash_history in root home. I do see .bashrc, .profile, and .ssh but no .bash_history unless I go to the /home/admin that's the only one I see. Well, I guess what I mean to say is there are three copies of the same file:
/MyDir/home/admin/.bash_history /run/nfs4/home/admin/.bash_history /home/admin/.bash_history
I suspect eveything is simlinked to the same admin home directory, but I didn't dig to deep because I don't really know how.
Are there any logs that indicate which users logged in with IP addresses?
Maybe also look in dpkg.log in the log zip file.
iceweasel wrote:
Are there any logs that indicate which users logged in with IP addresses?
None that I know for ssh. http.log contains login info for the web interface. If you have auditing enabled, there should be info in auditd.log - but AFAIK that doesn't include ssh logins.
If you are looking for recent activity, you can log in as root with ssh and enter
journalctl --no-pager -a -r | grep -i sshd
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
