Bonjour à tous,
Je suis utilisateur SME depuis quelques temps, sans aucun problème particulier et cette nuit, j'ai reçu ce mail de sme9admin-daemon@xxx:
Pourriez vous m'expliquer de ou cela vient? Ai je été hacké? Je suis sur qu'à l'heure affiché, personne (de connu) n'était connecté sur le serveur...
Merci pour votre retour.
------------------------------------
Thu May 18 21:35:05 2017
Status du serveur
Nombre de connexions ouvertes : ssh=0 ftp=0 vpn=0 netbios=0
#>tail /var/log/messages :
May 18 20:00:32 sme esmith::event[6914]: S30ldap-dump=action|Event|pre-backup|Action|S30ldap-dump|Start|1495130432 637650|End|1495130432 709644|Elapsed|0.071994
May 18 20:00:32 sme esmith::event[6914]: Running event handler: /etc/e-smith/events/pre-backup/S50rewind-tape
May 18 20:00:32 sme esmith::event[6914]: S50rewind-tape=action|Event|pre-backup|Action|S50rewind-tape|Start|1495130432 709839|End|1495130432 756186|Elapsed|0.046347
May 18 20:57:44 sme esmith::event[8101]: Processing event: post-backup
May 18 20:57:44 sme esmith::event[8101]: Running event handler: /etc/e-smith/events/post-backup/S10mysql-delete-dumped-tables
May 18 20:57:44 sme esmith::event[8101]: S10mysql-delete-dumped-tables=action|Event|post-backup|Action|S10mysql-delete-dumped-tables|Start|1495133864 960176|End|1495133864 979490|Elapsed|0.019314
May 18 20:57:44 sme esmith::event[8101]: Running event handler: /etc/e-smith/events/post-backup/S50rewind-tape
May 18 20:57:45 sme esmith::event[8101]: S50rewind-tape=action|Event|post-backup|Action|S50rewind-tape|Start|1495133864 979734|End|1495133865 26162|Elapsed|0.046428
May 18 20:57:45 sme esmith::event[8101]: Running event handler: /etc/e-smith/events/post-backup/S90eject-tape
May 18 20:57:45 sme esmith::event[8101]: S90eject-tape=action|Event|post-backup|Action|S90eject-tape|Start|1495133865 26432|End|1495133865 72729|Elapsed|0.046297
#>netstat --numeric-hosts -tpu :
Connexions Internet actives (sans serveurs)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.16.1.1:netbios-ssn 172.16.10.100:49183 ESTABLISHED 15662/smbd
tcp 1 0 127.0.0.1:40892 127.0.0.1:squid CLOSE_WAIT 36353/(squidclamav)
tcp 1 0 127.0.0.1:40902 127.0.0.1:squid CLOSE_WAIT 36355/(squidclamav)
tcp 1 0 127.0.0.1:44756 127.0.0.1:squid CLOSE_WAIT 36326/(squidclamav)
tcp 1 0 127.0.0.1:41098 127.0.0.1:squid CLOSE_WAIT 36342/(squidclamav)
tcp 1 0 127.0.0.1:41168 127.0.0.1:squid CLOSE_WAIT 36353/(squidclamav)
tcp 1 0 127.0.0.1:44758 127.0.0.1:squid CLOSE_WAIT 36327/(squidclamav)
tcp 1 0 127.0.0.1:40850 127.0.0.1:squid CLOSE_WAIT 36334/(squidclamav)
tcp 1 0 127.0.0.1:40916 127.0.0.1:squid CLOSE_WAIT 36353/(squidclamav)
tcp 1 0 127.0.0.1:44860 127.0.0.1:squid CLOSE_WAIT 36321/(squidclamav)
tcp 1 0 127.0.0.1:40898 127.0.0.1:squid CLOSE_WAIT 36362/(squidclamav)
tcp 1 0 127.0.0.1:40976 127.0.0.1:squid CLOSE_WAIT 36330/(squidclamav)
tcp 1 0 127.0.0.1:41142 127.0.0.1:squid CLOSE_WAIT 36338/(squidclamav)
tcp 1 0 127.0.0.1:41124 127.0.0.1:squid CLOSE_WAIT 36339/(squidclamav)
tcp 1 0 127.0.0.1:40858 127.0.0.1:squid CLOSE_WAIT 36338/(squidclamav)
tcp 1 0 127.0.0.1:40896 127.0.0.1:squid CLOSE_WAIT 36354/(squidclamav)
tcp 1 0 127.0.0.1:40874 127.0.0.1:squid CLOSE_WAIT 36344/(squidclamav)
tcp 1 0 127.0.0.1:45532 127.0.0.1:squid CLOSE_WAIT 36306/(squidclamav)
tcp 1 0 127.0.0.1:45126 127.0.0.1:squid CLOSE_WAIT 36317/(squidclamav)
tcp 1 0 127.0.0.1:40884 127.0.0.1:squid CLOSE_WAIT 36346/(squidclamav)
tcp 1 0 127.0.0.1:44868 127.0.0.1:squid CLOSE_WAIT 36322/(squidclamav)
tcp 1 0 127.0.0.1:45210 127.0.0.1:squid CLOSE_WAIT 36316/(squidclamav)
tcp 1 0 127.0.0.1:40888 127.0.0.1:squid CLOSE_WAIT 36349/(squidclamav)
tcp 0 0 ::ffff:192.168.1.10:47712 ::ffff:77.234.43.35:http TIME_WAIT -
#>service httpd-e-smith status
run: /service/httpd-e-smith: (pid 7138) 222960s, normally down
#>service httpd-admin status
run: /service/httpd-admin: (pid 7118) 222960s, normally down; run: log: (pid 1125) 223039s
#>service smb status
smbd (pid 7284) en cours d'exécution...
#>service sshd status
openssh-daemon (pid 7099) en cours d'exécution...
---------------------------------------------------------------------------------------------------