Is this machine compromised? (iRedMail server, weird logs)

Question

I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked.

11 times: [2016-11-19 22:20:19 ±3 seconds] password authentication failed for user "postgres"

I haven't tried to log in as postgres. There are no entries like this from previous days. I don't think PostgreSQL is even supposed to accept connections from the internet.

From 5 days ago:

--ALERT-- [perm023a] /bin/su is setuid to `root'. 
--ALERT-- [perm023a] /usr/bin/at is setuid to `daemon'. 
--ALERT-- [perm024a] /usr/bin/at is setgid to `daemon'. 
--WARN-- [perm001w] The owner of /usr/bin/at should be root (owned by daemon). 
--WARN-- [perm002w] The group owner of /usr/bin/at should be root. 
--ALERT-- [perm023a] /usr/bin/passwd is setuid to `root'. 
--ALERT-- [perm024a] /usr/bin/wall is setgid to `tty'. 

I have no idea what that's about.

Today I got this:

NEW: --WARN-- [lin002i] The process `python' is listening on socket 47178 (UDP) on every interface.

I can see 2 python processes, one running under iredapd (related to iRedMail), one under root. According to the "open ports" page on iRedMail's website, there shouldn't be anything like this. Then again, I don't actually see the open port with nmap.

From 6 days ago (noticed it just now):

Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... --WARN-- [rootkit004w] Chkrootkit has detected a possible rootkit installation Possible Linux/Ebury - Operation Windigo installetd

From googling a bit it seems like a false positive, but I'm not sure.

How should I look into this?

Answer 1

In Linux (or other Unices), a setuid program is a program that should run with the rights of the program owner, not the one who called it. For example, if you type ping google.com, ping will likely be run as root to allow receiving ICMP packets. This is not a security hole, as ping doesn't allow shell escapes. All the programs listed have a reason to be setuid, and are nothing to worry about.

• su needs to run as root to switch its user id.
• at needs to run the command as the user it was asked to run as.
• passwd needs to read /etc/shadow, and therefore must be root.
• wall needs to write to other people's terminals, and therefore must run as that group.

The chkrootkit warning is more concerning, as well as the Python network port incident. Try scanning the ports locally (nmap localhost via SSH), and see if the port is open, as even if it's bound to all interfaces, the port may still be firewalled from the outside. Try using strace to find out what files the Python process is opening, or better yet, use ps to find out the command line arguments Python received, and just locate the script to see what it does.

I'm not an expert in PostgreSQL, but I assume not allowing login from the Internet means replying "unauthorized" to everyone, therefore it may still show up in logs. Some script kiddies always run scans with default passwords to see which servers they can get into. The fact that it says failed login is a good thing.