Mutant ~/.bashrc

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

Hello.

Te point is some lines of my .bashrc are changing alone, I have a cute ascii bear as user welcome who as my prompt is deformed sometimes, the ~/.bashrc lines are:

ThomasAdam · Guru Joined: 20 Mar 2005 Posts: 448 Location: England

Aww, cute bear.

Does it actually render like that changed?

-- Thomas Adam

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

Mmmm I don't understand you very well, my english is a bit poor :/

Do you mean if bear and prompt are shown correctly in the terminal even if the .bashrc change? No, they look deformed in terminal if the .bashrc is deformed. I take a snapshot: http://img91.imageshack.us/img91/6900/mutantbearim5.jpg
Looks like a car knocked down the bear.

Actually I "solved" it removing the write permission of my user to .bashrc but I think this is not a clear solution and still missunderstanding why .bashrc changes alone. I think the point is in the characters before deformation the "´" and the "·", the deformed characters always appear there.

platojones · Posted: Thu Nov 22, 2007 7:09 pm Post subject:

It's pretty obvious that some application is writing to your .bashrc. I'm not sure what would do that as it seems like a very bad idea (and it may have serious security implications). In other words, nothing should be writing to your .bashrc and if it is, it is probably bad. I think you may want to emerge chkrootkit or some other rootkit detection utility to ensure that your box has not been compromised.

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

platojones · Posted: Thu Nov 22, 2007 11:57 pm Post subject:

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

platojones · Posted: Fri Nov 23, 2007 12:39 am Post subject:

platojones · Posted: Fri Nov 23, 2007 12:48 am Post subject:

BTW, there is one other possibility that I didn't consider earlier. You hard disk may be corrupted to some extent. Have you run fsck on it lately?

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

platojones · Posted: Fri Nov 23, 2007 2:24 am Post subject:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23082

Those iptables rules look wrong. Specifically, the second to last rule on the INPUT chain appears to allow far too much. This may be OK, since you are not showing all criteria. In the future, I recommend using iptables-save -c to list the contents of your iptables rules. It shows all tables, shows packet counters, and shows all conditions. Also, the output is machine readable, so other users can analyze it more easily.

I suggest you use the enclosed script as a starting point, and modify it as needed to poke specific holes for the services you intend to allow. It is designed to provide a simple and safe filter for a workstation. Ultimately, you may be better served by a more user friendly firewall, but this should protect you until you have time to configure and activate your firewall front end of choice.

mark_alec · Posted: Sun Nov 25, 2007 1:46 am Post subject:

Moved from Other Things Gentoo to Networking & Security.
_________________
www.gentoo.org.au || #gentoo-au

Cereza · Guru Joined: 14 Apr 2006 Posts: 428

Thank you all.

Finally I made a new installation but still thinking the issue was about the special characters and not about a security fail/intrussion, now I placed "." instead of "·" in prompt and "-" and "\" instead "´" in the poor bear, who now looks like this:

swimmer · Posted: Mon Nov 26, 2007 10:34 am Post subject:

Back to "Other Things Gentoo" then? ;-)