I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked.
11 times: [2016-11-19 22:20:19 ±3 seconds] password authentication failed for user "postgres"
I haven't tried to log in as postgres. There are no entries like this from previous days. I don't think PostgreSQL is even supposed to accept connections from the internet.
From 5 days ago:
--ALERT-- [perm023a] /bin/su is setuid to `root'. --ALERT-- [perm023a] /usr/bin/at is setuid to `daemon'. --ALERT-- [perm024a] /usr/bin/at is setgid to `daemon'. --WARN-- [perm001w] The owner of /usr/bin/at should be root (owned by daemon). --WARN-- [perm002w] The group owner of /usr/bin/at should be root. --ALERT-- [perm023a] /usr/bin/passwd is setuid to `root'. --ALERT-- [perm024a] /usr/bin/wall is setgid to `tty'.
I have no idea what that's about.
Today I got this:
NEW: --WARN-- [lin002i] The process `python' is listening on socket 47178 (UDP) on every interface.
I can see 2 python processes, one running under iredapd (related to iRedMail), one under root. According to the "open ports" page on iRedMail's website, there shouldn't be anything like this. Then again, I don't actually see the open port with nmap.
From 6 days ago (noticed it just now):
Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... --WARN-- [rootkit004w] Chkrootkit has detected a possible rootkit installation Possible Linux/Ebury - Operation Windigo installetd
From googling a bit it seems like a false positive, but I'm not sure.
How should I look into this?