Conteúdo do diretório /usr/lib/sudo sumindo

eduardomizael
(usa Outra)

Enviado em 15/02/2021 - 21:03h

Meu problema ocorre especificamente com a distribuição do ubuntu server 20.04 e 20.10 para raspberry pi.
Não consegui estabelecer uma relação concreta, mas aparentemente isso acontece depois de instalado o postgresql, mas não posso afirmar com certeza.

Ao instalar e configurar o sistema tudo funciona muito bem, no entanto, ao reiniciar o sistema já durante o boot eu verifico que alguns erros acontecem.
Ao fazer o login e tentar executar qualquer ação com sudo, recebo a mensagem:
sudo: error while loading shared libraries: libsudo_util.so.0: cannot open shared object file: No such file or directory.
Através de um post, aqui mesmo no forum, descobri que o erro era no diretório /usr/lib/sudo.
Ao verificar, notei que os arquivos sumiram de lá.
Já refiz a instalação varias vezes tentando isolar o problema mas não cheguei a uma conclusão.
As vezes reiniciando o sistema manualmente já ocorre o problema, mas por vezes não acontece nada.
O sistema roda por dias ligado sem problemas, mas notei que desligamentos abruptos, por queda de energia são fatores que contribuem para que ocorra.
Se alguém tiver alguma ideia, aceito sugestões de todo modo, pois não sei mais pra onde correr.

leandropscardua
(usa Ubuntu)

Enviado em 15/02/2021 - 21:11h

Tente este comando p ver se tem alguma informação
grep "/usr/lib/sudo" /var/log/auth
Será necessário root p executar. /var/log/auth mantém informação dos comandos rodados como root

eduardomizael
(usa Outra)

Enviado em 15/02/2021 - 23:04h

Fui verificar os logs de acordo com a sua indicação e acabei encontrando algo muito estranho

no dia ontem iniciando as 00:04 começa a ser gerado uma serie e entradas indicando erros de autenticação e outras coisas que eu não entendi muito bem.
dessa hora até por volta das 18:37 tiveram quase 14 mil eventos.
No dia de hoje tem alguns eventos a partir do horário que eu detectei que não estava mais rodando corretamente e comecei a fazer testes.

Vou colocar aqui os últimos eventos de ontem, nao tenho ideia do que seja muita coisa, mas tem cara de tentativas de acesso, ou ataque. Se alguem puder explicar o que seja ou tiver qualquer suposição já ajuda.

Segue o log:
Feb 14 18:25:01 ubuntu CRON[144257]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb 14 18:25:01 ubuntu CRON[144257]: pam_unix(cron:session): session closed for user root
Feb 14 18:25:27 ubuntu sshd[144263]: Unable to negotiate with 192.236.179.246 port 36560: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Feb 14 18:26:48 ubuntu sshd[144269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:26:50 ubuntu sshd[144269]: Failed password for root from 221.181.185.29 port 10183 ssh2
Feb 14 18:26:57 ubuntu sshd[144269]: message repeated 2 times: [ Failed password for root from 221.181.185.29 port 10183 ssh2]
Feb 14 18:26:58 ubuntu sshd[144269]: Received disconnect from 221.181.185.29 port 10183:11: [preauth]
Feb 14 18:26:58 ubuntu sshd[144269]: Disconnected from authenticating user root 221.181.185.29 port 10183 [preauth]
Feb 14 18:26:58 ubuntu sshd[144269]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:27:01 ubuntu sshd[144271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:27:03 ubuntu sshd[144271]: Failed password for root from 221.181.185.29 port 59002 ssh2
Feb 14 18:27:10 ubuntu sshd[144271]: message repeated 2 times: [ Failed password for root from 221.181.185.29 port 59002 ssh2]
Feb 14 18:27:11 ubuntu sshd[144271]: Received disconnect from 221.181.185.29 port 59002:11: [preauth]
Feb 14 18:27:11 ubuntu sshd[144271]: Disconnected from authenticating user root 221.181.185.29 port 59002 [preauth]
Feb 14 18:27:11 ubuntu sshd[144271]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:27:14 ubuntu sshd[144274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:27:16 ubuntu sshd[144274]: Failed password for root from 221.181.185.29 port 44278 ssh2
Feb 14 18:27:22 ubuntu sshd[144274]: message repeated 2 times: [ Failed password for root from 221.181.185.29 port 44278 ssh2]
Feb 14 18:27:24 ubuntu sshd[144274]: Received disconnect from 221.181.185.29 port 44278:11: [preauth]
Feb 14 18:27:24 ubuntu sshd[144274]: Disconnected from authenticating user root 221.181.185.29 port 44278 [preauth]
Feb 14 18:27:24 ubuntu sshd[144274]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185.29 user=root
Feb 14 18:31:17 ubuntu sshd[144294]: Unable to negotiate with 192.236.179.246 port 47162: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Feb 14 18:32:31 ubuntu sshd[144301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.154 user=root
Feb 14 18:32:33 ubuntu sshd[144301]: Failed password for root from 141.98.81.154 port 44102 ssh2
Feb 14 18:32:34 ubuntu sshd[144301]: Connection closed by authenticating user root 141.98.81.154 port 44102 [preauth]
Feb 14 18:34:04 ubuntu sshd[144312]: Unable to negotiate with 192.236.179.246 port 33062: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Feb 14 18:35:01 ubuntu CRON[144317]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb 14 18:35:01 ubuntu CRON[144317]: pam_unix(cron:session): session closed for user root
Feb 14 18:37:04 ubuntu sshd[144330]: Unable to negotiate with 192.236.179.246 port 54208: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Feb 14 18:37:39 ubuntu sshd[144334]: Invalid user admin from 141.98.81.154 port 52385
Feb 14 18:37:39 ubuntu sshd[144334]: pam_unix(sshd:auth): check pass; user unknown
Feb 14 18:37:39 ubuntu sshd[144334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.154
Feb 14 18:37:41 ubuntu sshd[144334]: Failed password for invalid user admin from 141.98.81.154 port 52385 ssh2
Feb 14 18:37:42 ubuntu sshd[144334]: Connection closed by invalid user admin 141.98.81.154 port 52385 [preauth]
Feb 14 18:40:05 ubuntu sshd[144348]: Unable to negotiate with 192.236.179.246 port 48850: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Feb 14 18:27:48 ubuntu systemd-logind[1658]: Watching system buttons on /dev/input/event0 (USB USB Keykoard)
Feb 14 18:27:48 ubuntu systemd-logind[1658]: Watching system buttons on /dev/input/event1 (USB USB Keykoard Consumer Control)
Feb 14 18:27:48 ubuntu systemd-logind[1658]: Watching system buttons on /dev/input/event2 (USB USB Keykoard System Control)
Feb 14 18:27:48 ubuntu systemd-logind[1658]: New seat seat0.
Feb 14 18:27:50 ubuntu sshd[1724]: Server listening on 0.0.0.0 port 22.
Feb 14 18:27:50 ubuntu sshd[1724]: Server listening on :: port 22.
Feb 15 16:29:01 ubuntu login[1712]: pam_unix(login:auth): Couldn't open /etc/securetty: No such file or directory
Feb 15 16:29:06 ubuntu login[1712]: pam_unix(login:auth): Couldn't open /etc/securetty: No such file or directory
Feb 15 16:29:12 ubuntu login[1712]: pam_unix(login:session): session opened for user ubuntu by LOGIN(uid=0)
Feb 15 16:29:12 ubuntu systemd-logind[1658]: New session 1 of user ubuntu.
Feb 15 16:29:12 ubuntu systemd: pam_unix(systemd-user:session): session opened for user ubuntu by (uid=0)
Feb 15 16:30:48 ubuntu systemd-logind[1651]: Watching system buttons on /dev/input/event0 (USB USB Keykoard)
Feb 15 16:30:48 ubuntu systemd-logind[1651]: Watching system buttons on /dev/input/event1 (USB USB Keykoard Consumer Control)
Feb 15 16:30:48 ubuntu systemd-logind[1651]: Watching system buttons on /dev/input/event2 (USB USB Keykoard System Control)