need help with root hack 1049

Don't trust your box anymore. Apparantly some program has been installed to take the place of bash. Hard to tell from here which version you are using yourself right now. Easy to guess the new Bash does more than handle your keystrokes for you....

Your (his) bashhistory stops there, simply because a new bash has taken over. buttUME the worst!

Was testuser a user you created before? What do your firewall rules-policies look like ? (which) Users allowed to SSh to your machine from remote locations? What services do you have running at opened ports?

Don't throw the 'evidence' away!. save it in an archive on a cdrom or diskette and keep that for later analysis. Be glad you FOUND the evidence, many hacked boxen are only discovered as such much later. Block the user, kill the WAN connection.

Maybe you can try nmap to see what ports are open on your box to the outside world. If you want me or someone else to have a look what ports are open, you could pm someone, or better, use an online service to have your pc scanned. Better still (as long as you are sure no other hosts on your LAN are affected), run nmap on those to see what services-ports your compromised box advertises through the firewall.

chkrootkit and rkhunter (both available as yum-able rpms I believe) can help spot rootkits on your box.

New setup is advisable, if not mandatory. Someone installing his own bash surely isn't doing that just to see if he can...

Next install, make sure you use tripwire or AIDE or similar to make a checksum database of all the relevant stuff on your machine. That way you at least can easily detect which programs-files have been affected after a break-in. Be sure to keep the database up-to-date and stored somewhere safe (i.e. write-once media or external device, floppies, etc etc.)

HTH Sh.