What are these commands for

broyuken1 · October 30, 2023, 12:49am

I just logged into my HA server and noticed a bunch of weird logs in my history. I’ve never run any of these and am wondering if this is something from Nabu Casa or if I’ve somehow been hacked or something. My HA is not open to ssh from the internet, only on 443 so I’m not sure how someone would have access to the shell.

Here is what I have in my history, and this repeats few times over. Truncated in the comment, full paste in the pastebin

1120  echo phoenixSOF; id; echo phoenixEOF
 1121  echo phoenixSOF; which lsb_release; echo phoenixEOF
 1122  echo phoenixSOF; lsb_release -idrc; echo phoenixEOF
 1123  echo phoenixSOF; cat /etc/lsb-release; echo phoenixEOF
 1124  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1125  echo phoenixSOF; cat /etc/vmware-release; echo phoenixEOF
 1126  echo phoenixSOF; cat /etc/oracle-release; echo phoenixEOF
 1127  echo phoenixSOF; cat /etc/mandrake-release; echo phoenixEOF
 1128  echo phoenixSOF; cat /etc/SuSE-release; echo phoenixEOF
 1129  echo phoenixSOF; cat /etc/redhat-release; echo phoenixEOF
 1130  echo phoenixSOF; cat /etc/slackware-version; echo phoenixEOF
 1131  echo phoenixSOF; cat /etc/immunix-release; echo phoenixEOF
 1132  echo phoenixSOF; cat /etc/turbolinux-release; echo phoenixEOF
 1133  echo phoenixSOF; cat /etc/msclinux-release; echo phoenixEOF
 1134  echo phoenixSOF; cat /etc/lanthan-release; echo phoenixEOF
 1135  echo phoenixSOF; cat /etc/yellowdog-release; echo phoenixEOF
 1136  echo phoenixSOF; cat /etc/coherent-release; echo phoenixEOF
 1137  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1138  echo phoenixSOF; cat /etc/gentoo-release; echo phoenixEOF
 1139  echo phoenixSOF; cat /etc/debian-version; echo phoenixEOF
 1140  echo phoenixSOF; cat /etc/issue; echo phoenixEOF
 1141  echo phoenixSOF; uname -i; echo phoenixEOF
 1142  echo phoenixSOF; uname -sr; echo phoenixEOF
 1143  echo phoenixSOF; uname -n; echo phoenixEOF
 1144  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1145  echo phoenixSOF; cat /etc/system-release; echo phoenixEOF
 1146  echo phoenixSOF; echo $SHELL; echo phoenixEOF
 1147  echo phoenixSOF; date +%D;date +%T; echo phoenixEOF
 1148  echo phoenixSOF; echo $LANG; echo phoenixEOF
 1149  echo phoenixSOF; export LANG=en_US.utf8; echo phoenixEOF
 1150  echo phoenixSOF; echo $LANG; echo phoenixEOF
 1151  echo phoenixSOF; echo $SHELL; echo phoenixEOF
 1152  echo phoenixSOF; cnt=0; for s in one two three; do echo $s; cnt+=1; done; echo $cnt items; echo phoenixEOF
 1153  echo phoenixSOF; cat /etc/ssh/sshd_config /opt/ssh/etc/sshd_config /usr/local/etc/sshd_config /etc/sshd_config /etc/openssh/sshd_config /usr/openssh/etc/sshd_config /opt/csw/etc/ssh/sshd_config 2> /dev/null | grep -i authorizedkeysfile; echo phoenixEOF
 1154  echo phoenixSOF; sudo -n -l -U root; echo phoenixEOF
 1155  echo phoenixSOF; cat /etc/passwd | head -n 100; echo phoenixEOF
 1156  echo phoenixSOF; cat /etc/shadow | head -n 100; echo phoenixEOF
 1157  echo phoenixSOF; id -nG root; echo phoenixEOF
 1158  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1159  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1160  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1161  echo phoenixSOF; id -nG bin; echo phoenixEOF
 1162  echo phoenixSOF; echo '/bin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/bin/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1163  echo phoenixSOF; echo '/bin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/bin//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1164  echo phoenixSOF; echo '/bin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/bin/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1165  echo phoenixSOF; id -nG daemon; echo phoenixEOF
 1166  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1167  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1168  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1169  echo phoenixSOF; id -nG adm; echo phoenixEOF
 1170  echo phoenixSOF; echo '/var/adm/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/adm/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1171  echo phoenixSOF; echo '/var/adm/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/adm//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1172  echo phoenixSOF; echo '/var/adm/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/adm/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1173  echo phoenixSOF; id -nG lp; echo phoenixEOF
 1174  echo phoenixSOF; echo '/var/spool/lpd/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/lpd/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1175  echo phoenixSOF; echo '/var/spool/lpd/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/lpd//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1176  echo phoenixSOF; echo '/var/spool/lpd/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/lpd/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1177  echo phoenixSOF; id -nG sync; echo phoenixEOF
 1178  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1179  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1180  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1181  echo phoenixSOF; id -nG shutdown; echo phoenixEOF
 1182  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1183  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1184  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1185  echo phoenixSOF; id -nG halt; echo phoenixEOF
 1186  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1187  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1188  echo phoenixSOF; echo '/sbin/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/sbin/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1189  echo phoenixSOF; id -nG mail; echo phoenixEOF
 1190  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1191  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1192  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1193  echo phoenixSOF; id -nG news; echo phoenixEOF
 1194  echo phoenixSOF; echo '/usr/lib/news/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/lib/news/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1195  echo phoenixSOF; echo '/usr/lib/news/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/lib/news//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1196  echo phoenixSOF; echo '/usr/lib/news/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/lib/news/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1197  echo phoenixSOF; id -nG uucp; echo phoenixEOF
 1198  echo phoenixSOF; echo '/var/spool/uucppublic/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/uucppublic/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1199  echo phoenixSOF; echo '/var/spool/uucppublic/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/uucppublic//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1200  echo phoenixSOF; echo '/var/spool/uucppublic/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/uucppublic/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1201  echo phoenixSOF; id -nG operator; echo phoenixEOF
 1202  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1203  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1204  echo phoenixSOF; echo '/root/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/root/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1205  echo phoenixSOF; id -nG man; echo phoenixEOF
 1206  echo phoenixSOF; echo '/usr/man/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/man/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1207  echo phoenixSOF; echo '/usr/man/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/man//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1208  echo phoenixSOF; echo '/usr/man/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/man/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1209  echo phoenixSOF; id -nG postmaster; echo phoenixEOF
 1210  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1211  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1212  echo phoenixSOF; echo '/var/mail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/mail/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1213  echo phoenixSOF; id -nG cron; echo phoenixEOF
 1214  echo phoenixSOF; echo '/var/spool/cron/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1215  echo phoenixSOF; echo '/var/spool/cron/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1216  echo phoenixSOF; echo '/var/spool/cron/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1217  echo phoenixSOF; id -nG ftp; echo phoenixEOF
 1218  echo phoenixSOF; echo '/var/lib/ftp/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/lib/ftp/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1219  echo phoenixSOF; echo '/var/lib/ftp/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/lib/ftp//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1220  echo phoenixSOF; echo '/var/lib/ftp/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/lib/ftp/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1221  echo phoenixSOF; id -nG sshd; echo phoenixEOF
 1222  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1223  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1224  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1225  echo phoenixSOF; id -nG at; echo phoenixEOF
 1226  echo phoenixSOF; echo '/var/spool/cron/atjobs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron/atjobs/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1227  echo phoenixSOF; echo '/var/spool/cron/atjobs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron/atjobs//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1228  echo phoenixSOF; echo '/var/spool/cron/atjobs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/cron/atjobs/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1229  echo phoenixSOF; id -nG squid; echo phoenixEOF
 1230  echo phoenixSOF; echo '/var/cache/squid/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/cache/squid/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1231  echo phoenixSOF; echo '/var/cache/squid/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/cache/squid//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1232  echo phoenixSOF; echo '/var/cache/squid/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/cache/squid/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1233  echo phoenixSOF; id -nG xfs; echo phoenixEOF
 1234  echo phoenixSOF; echo '/etc/X11/fs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/etc/X11/fs/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1235  echo phoenixSOF; echo '/etc/X11/fs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/etc/X11/fs//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1236  echo phoenixSOF; echo '/etc/X11/fs/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/etc/X11/fs/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1237  echo phoenixSOF; id -nG games; echo phoenixEOF
 1238  echo phoenixSOF; echo '/usr/games/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/games/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1239  echo phoenixSOF; echo '/usr/games/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/games//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1240  echo phoenixSOF; echo '/usr/games/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/games/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1241  echo phoenixSOF; id -nG cyrus; echo phoenixEOF
 1242  echo phoenixSOF; echo '/usr/cyrus/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/cyrus/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1243  echo phoenixSOF; echo '/usr/cyrus/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/cyrus//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1244  echo phoenixSOF; echo '/usr/cyrus/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/usr/cyrus/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1245  echo phoenixSOF; id -nG vpopmail; echo phoenixEOF
 1246  echo phoenixSOF; echo '/var/vpopmail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/vpopmail/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1247  echo phoenixSOF; echo '/var/vpopmail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/vpopmail//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1248  echo phoenixSOF; echo '/var/vpopmail/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/vpopmail/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1249  echo phoenixSOF; id -nG ntp; echo phoenixEOF
 1250  echo phoenixSOF; echo '/var/empty/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/empty/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1251  echo phoenixSOF; echo '/var/empty/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/empty//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1252  echo phoenixSOF; echo '/var/empty/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/empty/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1253  echo phoenixSOF; id -nG smmsp; echo phoenixEOF
 1254  echo phoenixSOF; echo '/var/spool/mqueue/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/mqueue/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1255  echo phoenixSOF; echo '/var/spool/mqueue/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/mqueue//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1256  echo phoenixSOF; echo '/var/spool/mqueue/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/var/spool/mqueue/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1257  echo phoenixSOF; id -nG guest; echo phoenixEOF
 1258  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1259  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1260  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1261  echo phoenixSOF; id -nG nobody; echo phoenixEOF
 1262  echo phoenixSOF; echo '//AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '//AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1263  echo phoenixSOF; echo '//AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '///etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1264  echo phoenixSOF; echo '//AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '//~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1265  echo phoenixSOF; id -nG messagebus; echo phoenixEOF
 1266  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/AuthorizedKeysFile' 2> /dev/null; echo phoenixEOF
 1267  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null//etc/ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1268  echo phoenixSOF; echo '/dev/null/AuthorizedKeysFile /etc/ssh/authorized_keys ~/.ssh/authorized_keys'; cat '/dev/null/~/.ssh/authorized_keys' 2> /dev/null; echo phoenixEOF
 1269  echo phoenixSOF; last -F root | head -n 1; echo phoenixEOF
 1270  echo phoenixSOF; sudo -l -U root; echo phoenixEOF
 1271  echo phoenixSOF; last -F bin | head -n 1; echo phoenixEOF
 1272  echo phoenixSOF; sudo -l -U bin; echo phoenixEOF
 1273  echo phoenixSOF; last -F daemon | head -n 1; echo phoenixEOF
 1274  echo phoenixSOF; sudo -l -U daemon; echo phoenixEOF
 1275  echo phoenixSOF; last -F adm | head -n 1; echo phoenixEOF
 1276  echo phoenixSOF; sudo -l -U adm; echo phoenixEOF
 1277  echo phoenixSOF; last -F lp | head -n 1; echo phoenixEOF
 1278  echo phoenixSOF; sudo -l -U lp; echo phoenixEOF
 1279  echo phoenixSOF; last -F sync | head -n 1; echo phoenixEOF
 1280  echo phoenixSOF; sudo -l -U sync; echo phoenixEOF
 1281  echo phoenixSOF; last -F shutdown | head -n 1; echo phoenixEOF
 1282  echo phoenixSOF; sudo -l -U shutdown; echo phoenixEOF
 1283  echo phoenixSOF; last -F halt | head -n 1; echo phoenixEOF
 1284  echo phoenixSOF; sudo -l -U halt; echo phoenixEOF
 1285  echo phoenixSOF; last -F mail | head -n 1; echo phoenixEOF
 1286  echo phoenixSOF; sudo -l -U mail; echo phoenixEOF
 1287  echo phoenixSOF; last -F news | head -n 1; echo phoenixEOF
 1288  echo phoenixSOF; sudo -l -U news; echo phoenixEOF
 1289  echo phoenixSOF; last -F uucp | head -n 1; echo phoenixEOF
 1290  echo phoenixSOF; sudo -l -U uucp; echo phoenixEOF
 1291  echo phoenixSOF; last -F operator | head -n 1; echo phoenixEOF
 1292  echo phoenixSOF; sudo -l -U operator; echo phoenixEOF
 1293  echo phoenixSOF; last -F man | head -n 1; echo phoenixEOF
 1294  echo phoenixSOF; sudo -l -U man; echo phoenixEOF
 1295  echo phoenixSOF; last -F postmaster | head -n 1; echo phoenixEOF
 1296  echo phoenixSOF; sudo -l -U postmaster; echo phoenixEOF
 1297  echo phoenixSOF; last -F cron | head -n 1; echo phoenixEOF
 1298  echo phoenixSOF; sudo -l -U cron; echo phoenixEOF
 1299  echo phoenixSOF; last -F ftp | head -n 1; echo phoenixEOF
 1300  echo phoenixSOF; sudo -l -U ftp; echo phoenixEOF
 1301  echo phoenixSOF; last -F sshd | head -n 1; echo phoenixEOF
 1302  echo phoenixSOF; sudo -l -U sshd; echo phoenixEOF
 1303  echo phoenixSOF; last -F at | head -n 1; echo phoenixEOF
 1304  echo phoenixSOF; sudo -l -U at; echo phoenixEOF
 1305  echo phoenixSOF; last -F squid | head -n 1; echo phoenixEOF
 1306  echo phoenixSOF; sudo -l -U squid; echo phoenixEOF
 1307  echo phoenixSOF; last -F xfs | head -n 1; echo phoenixEOF
 1308  echo phoenixSOF; sudo -l -U xfs; echo phoenixEOF
 1309  echo phoenixSOF; last -F games | head -n 1; echo phoenixEOF
 1310  echo phoenixSOF; sudo -l -U games; echo phoenixEOF
 1311  echo phoenixSOF; last -F cyrus | head -n 1; echo phoenixEOF
 1312  echo phoenixSOF; sudo -l -U cyrus; echo phoenixEOF
 1313  echo phoenixSOF; last -F vpopmail | head -n 1; echo phoenixEOF
 1314  echo phoenixSOF; sudo -l -U vpopmail; echo phoenixEOF
 1315  echo phoenixSOF; last -F ntp | head -n 1; echo phoenixEOF
 1316  echo phoenixSOF; sudo -l -U ntp; echo phoenixEOF
 1317  echo phoenixSOF; last -F smmsp | head -n 1; echo phoenixEOF
 1318  echo phoenixSOF; sudo -l -U smmsp; echo phoenixEOF
 1319  echo phoenixSOF; last -F guest | head -n 1; echo phoenixEOF
 1320  echo phoenixSOF; sudo -l -U guest; echo phoenixEOF
 1321  echo phoenixSOF; last -F nobody | head -n 1; echo phoenixEOF
 1322  echo phoenixSOF; sudo -l -U nobody; echo phoenixEOF
 1323  echo phoenixSOF; last -F messagebus | head -n 1; echo phoenixEOF
 1324  echo phoenixSOF; sudo -l -U messagebus; echo phoenixEOF
 1325  echo phoenixSOF; cat /etc/passwd | cut -f 1 -d ":"; echo phoenixEOF
 1326  echo phoenixSOF; cat /etc/group 2> /dev/null | grep -v "^#" | head -n 100 | cut -f 1,3,4 -d ":"; echo phoenixEOF
 1327  echo phoenixSOF; which dpkg; echo $?; echo phoenixEOF
 1328  echo phoenixSOF; systemctl list-units --type service --all --plain --no-legend --no-pager | cut -f 1 -d " "; echo phoenixEOF
 1329  echo phoenixSOF; which dnf; echo $?; echo phoenixEOF
 1330  echo phoenixSOF; service -l; echo phoenixEOF
 1331  echo phoenixSOF; which yum; echo $?; echo phoenixEOF
 1332  echo phoenixSOF; which rpm; echo $?; echo phoenixEOF
 1333  echo phoenixSOF; service --status-all | grep " is "; echo phoenixEOF
 1334  echo phoenixSOF; which apt; echo $?; echo phoenixEOF
 1335  echo phoenixSOF; ls -1 /etc/init.d/ | sed 's/\x1B\[[0-9;]\{1,\}[A-Za-z]//g'; echo phoenixEOF
 1336  echo phoenixSOF; /etc/init.d/sshd status; echo phoenixEOF
 1337  echo phoenixSOF; sh -c "if [ -e /etc/pb.settings ] || [ -e /etc/pb.db ]; then pbversion; fi"; echo phoenixEOF
 1338  echo phoenixSOF; which chkconfig; echo $?; echo phoenixEOF
 1339  echo phoenixSOF; ls -1 /etc/xinetd.d/ | sed 's/\x1B\[[0-9;]\{1,\}[A-Za-z]//g'; echo phoenixEOF
 1340  BAD-COMMAND
 1341  uname -a
 1342  echo phoenixSOF; id; echo phoenixEOF
 1343  echo phoenixSOF; which lsb_release; echo phoenixEOF
 1344  echo phoenixSOF; lsb_release -idrc; echo phoenixEOF
 1345  echo phoenixSOF; cat /etc/lsb-release; echo phoenixEOF
 1346  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1347  echo phoenixSOF; cat /etc/vmware-release; echo phoenixEOF
 1348  echo phoenixSOF; cat /etc/oracle-release; echo phoenixEOF
 1349  echo phoenixSOF; cat /etc/mandrake-release; echo phoenixEOF
 1350  echo phoenixSOF; cat /etc/SuSE-release; echo phoenixEOF
 1351  echo phoenixSOF; cat /etc/redhat-release; echo phoenixEOF
 1352  echo phoenixSOF; cat /etc/slackware-version; echo phoenixEOF
 1353  echo phoenixSOF; cat /etc/immunix-release; echo phoenixEOF
 1354  echo phoenixSOF; cat /etc/turbolinux-release; echo phoenixEOF
 1355  echo phoenixSOF; cat /etc/msclinux-release; echo phoenixEOF
 1356  echo phoenixSOF; cat /etc/lanthan-release; echo phoenixEOF
 1357  echo phoenixSOF; cat /etc/yellowdog-release; echo phoenixEOF
 1358  echo phoenixSOF; cat /etc/coherent-release; echo phoenixEOF
 1359  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1360  echo phoenixSOF; cat /etc/gentoo-release; echo phoenixEOF
 1361  echo phoenixSOF; cat /etc/debian-version; echo phoenixEOF
 1362  echo phoenixSOF; cat /etc/issue; echo phoenixEOF
 1363  echo phoenixSOF; uname -i; echo phoenixEOF
 1364  echo phoenixSOF; uname -sr; echo phoenixEOF
 1365  echo phoenixSOF; uname -n; echo phoenixEOF
 1366  echo phoenixSOF; cat /etc/os-release; echo phoenixEOF
 1367  echo phoenixSOF; cat /etc/system-release; echo phoenixEOF

tom_l · October 30, 2023, 12:51am

They look like logs of shell commands.

WallyR · October 30, 2023, 1:02am

Who says HA and all the integrations and addons you have are secure?
HA is trying to implement security, but it is not a security product hardened for the internet and this security only goes for the HAOS and HA core part. All integrations and addons cann have their own interfaces with their own security or lack there of.

broyuken1 · October 30, 2023, 1:08am

they are logs of shell commands. I never ran them though. I’m wondering if this is some sort of script nabu casa runs or if its something I need to be concerned about. It looks like its just running a bunch of files and printing the output to the console. I don’t see any ssh logs other than from my own network. None of these commands on their own LOOK malicious, but they are trying to gather a bunch of information about my system. Is this the HA analytics running these commands or anything else known to the HA devs?

broyuken1 · October 30, 2023, 1:25am

nevermind, figured it out. I have an application on my network that runs discovery scans and these are some of the commands it runs, totally benign. I saw it, panicked and overreacted

WallyR · October 30, 2023, 1:26am

Discovery scans? You mean security scans, right?

broyuken1 · October 30, 2023, 1:28am

not really, its a scan that discovers privileged passwords and systems, services,software etc on your network to manage passwords and access to them. I completely forgot that it has credentials for HA

WallyR · October 30, 2023, 1:29am

ok, that makes sense why the keys and users were scanned then.

broyuken1 · October 30, 2023, 1:31am

yep, and after checking my HA ssh logs, one of the ips logging in was that box.