Re: Am I infected with a rootkit?

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

to make this mail on-topic:

Jesper Dybdal, do you see the riddling lines in file ~/.bash_history
of the superuser ?
If so: Do you see other strange lines there ? (Do they give more clue ?)


A bit less on-topic:

Greg Wooledge wrote:
> Bash doesn't read the contents of the history file into the in-memory
> history unless you run "history -r".  If you had some kind of ksh-like
> setup where you combined "history -w" and "history -r" commands in your
> PROMPT_COMMAND or other variables, then we might be able to reconcile
> the statements we've been given.
>
> In the absence of that, there's just no way you could have commands in
> your shell history that were not typed in that same shell session.

My Debians always behaved that way. I remember that in Debian 8 i got
several different readline histories in the first shell terminals which
i started. With Debian 11 it's only one history per user. It seems to be
a collection of the last commands of shell sessions when the recent
shutdowns happened.
For example i create a new xterm and get to see (from new to old):

  su -
  firefox-esr &
  top
  ps -ef | grep pulseaudio
  umgebung
  view /u/x
  su -
  firefox-esr &
  xset r rate 250 30

In man bash i read:

   When the -o history option to the set builtin  is  enabled,  the  shell
   provides access to the command history, [...]
   On startup, the history is initialized from the file named by the vari‐
   able HISTFILE (default ~/.bash_history).
   [...]
   set [--abefhkmnptuvxBCEHPT] [-o option-name] [arg ...]
   [...]
   -o option-name
     The option-name can be one of the following:
     [...]
      history Enable command history, as described above under
              HISTORY.  This option is on by default in inter‐
              active shells.

At the end of ~/.bash_history of my desktop user i see indeed above
history in old-to-new sequence:

  xset r rate 250 30
  firefox-esr &
  su -
  view /u/x
  umgebung
  ps -ef | grep pulseaudio
  top
  firefox-esr &
  su -

I did not execute them in this sequence in the recent sessions when i tried
to find out what made pulseaudio permenantly busy. They surely stem from
different xterms. It is not clear whether one per shutdown was memorized
or whether more then one stem from a single shutdown.

I become superuser by "su -" and get to see

  shutdown -h now
  shutdown -r now
  systemctl --global disable pulseaudio.service pulseaudio.socket
  shutdown -r now
  shutdown -h now
  shutdown -r now
  systemctl --global enable pulseaudio.service pulseaudio.socket
  shutdown -h now

Since i only had one superuser xterm, i can quite surely state that the
systemctl commands were not the last ones which were performed in their
respective shells before shutdown.


Have a nice day :)

Thomas