Hot answers tagged

11

Removal? Forget about it. There is unauthorised root access to your server; anything could have been installed by now and you would have no reliable way to detect it. Even for a forensic expert with local access, it would take a long time to completely audit a system to ensure no trace of extant malware. The only reasonable and responsible course is to ...


11

The short answer is this: No, CentOS 5.6 is inherently no more or less secure than any other modern supported operating system. The long answer is a bit more complicated. CentOS is the "Community" release of RedHat Enterprise Linux (RHEL). The differences between the two are fairly small so you can think of them as functionally equivalent, see the Wikipedia ...


10

You have already acknowledged that having no password is a bad idea due to the fact that your server can be accessible via the Internet. Without a sudo password, it means that you are relying on your public key authentication. If a vulnerability would be found in the authentication which allows an attacker to login: No sudo password It means that your ...


7

Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords. You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...


6

I am not completely sure, but you may want to look at the protocol setting in sshd_config. From http://wiki.centos.org/HowTos/Network/SecuringSSH # Protocol 2,1 Protocol 2 Change Protocol 1 to Protocol 2 and restart. This should already be set to Protocol 2 in Centos 6.5, but you may want to double check. I found this run down of the different protocol ...


6

First things first. Your machine was compromised, and several things were installed to keep it compromised. This cannot be salvaged; the machine should be cleansed with fire. You will not be able to avoid a complete format & reinstall. Your system is dead; shed a tear on it, then move on. Now, we are only talking about post-mortem analysis. The crontab ...


5

Found the way. vim /etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_10_whitelist.conf And add this line: SecRule REMOTE_ADDR "^192\.168\.50\.1$" phase:1,log,allow,ctl:ruleEngine=Off,id:999945


5

Another free option for long lasting support are the Ubuntu Server LTS "Long Term Support" releases. They offer updates for free for 5 years for server functionality from the initial release. And in this case you get the updates right away, directly from the provider. The CentOS page you link to generally shows support for each release over a 7-year life ...


4

You will never be able to gain complete confidence in your server again, you'll have to rebuild or restore from backups. If there are critical files you don't have backed up then boot to single-user mode, get your data, then wiperola. There are no tools, scanners, or methodologies that will enable you to be sure you're hack-free. Also, you could spend much ...


4

It can be exploited by log files injection. it might be possible to inject Apache log files, but these files needs root access to open, so it will not be possible to open them via LFI. to solve this problem, we inject temporary Apache log files, which are existed under this path: proc/self/fd/12 or proc/self/fd/14 or proc/<apachi pid>/fd/12 or ...


4

Well there is only one thing you can do: Now best thing is to refer to the stub about this on serverfault. If you are using your webserver for hosting different websites, the best thing you can do is make sure every site has its own user which is jailed. This will reduce the risk of getting your system compromised. (There might still be vulnerable ...


4

I think you're the proud owner of a "libworker.so" backdoor! Malware Must Die has a good analysis of it, read that before running it yourself. The Malware Must Die author isn't a native english speaker, but does disclose a ton of detail. Malware Must Die has the PHP "dropper" code getting downloaded via a copy of "Web Shell by oRb", so you're going to need ...


3

In addition to @DogEatCatWorld's answer, there is a more general piece of software called 'fail2ban' that can be configured to monitor log files for specific regular expressions and track IP addresses that act 'suspiciously' (for instance, multiple failed ssh login attempts within a certain timespan) and temporarily block the IP address at the firewall level....


3

I would install sshguard on this server to automatically block hosts trying to bruteforce your ssh accounts. It does this by adding the offending hosts to the firewall rules. An alternative to this is denyhosts which do more or less the same as sshguard, but uses /etc/hosts.deny instead of firewall rules to block the offenders.


3

The first port of call might be to take a packet dump (ie, tcpdump) and see what it is you're throwing out.


3

What you're experiencing is a common problem. Vulnerability scanners that rely upon service banners do not deal with vendors like Red Hat which backport security updates. They are also prone to making assumptions about configuration that lead to false positives. You may be able to improve the accuracy of the scan by running an credentialed scan. If your ...


3

Passwords of 8 or more characters are easy to type and good enough, if you don't use a common word and use combinations of capitals, small letters, numbers and special symbols. Only 8 character passwords is the mandate in many corporate companies. Such companies also force users to change their passwords in 2-3 months. Bruteforcing 8 characters password(...


3

If your system is compromised, you can't trust the OSSEC logs or any other logs generated from that machine. OSSEC is good for detecting new intrusions through log analysis. The command you give is used to detect which OSSEC rule will match the given log. So you are piping all the log files to the ossec-logtest utility and finding out if something matches ...


3

Going by what you originally posted about SSH, there is no evidence there that your server is compromised. It would be quite a round-the-houses way of breaking SSH for an attacker to resort to a default configuration. This is simply a warning message that your sshd or ssh might be misconfigured. RKHunter could not find a configuration value for the Protocol ...


3

Assuming your system is using regular simple unix authentication, there's at least one way of changing a password assuming you have root access. You can do this by simply editing the /etc/shadow file and pasting in a new password hash in place of the old one. This does not influence "chage -l" output as the change is done outside tools, so no other data (...


3

So it appears that the Red Hat errata and CentOS errata are the same numbers. This is Red Hat's format: RHSA-YYYY-#### And this is CentOS' format: CESA-YYYY:#### Where #### is the same number for both. So, to solve your example question, here's what I did: I went on the RedHat site and searched for the CVE number. This led me to the CVE page ...


3

It appears that your server has been hacked, possibly through a web server running PHP software. The sendmail header contains the following incriminating line: X-PHP-Originating-Script: 0:eb.php indicating that the email is generated using a PHP script with filename eb.php. The 0 indicates that the script is executed by root user, which could mean that a ...


3

This code loads content from a remote server and injects it into your website, but not when the useragent is a searchengine bot or specific $_SERVER variables are not set. Related question on SO: http://stackoverflow.com/a/29433260/753676 And some more details: http://www.lowendtalk.com/discussion/52704/php-code-injection-xetqlznzyr This seems to be the ...


2

The answer is no, this doesn't mean you are immune to this attack. If an attacker is unable to compile the exploit on your system, he can as well compile it somewhere else and then upload and run it on your server, providing he has an access to your server of course. Generally speaking, you should not rely on denying access to gcc or any other utility to ...


2

Technically, a filesystem stores files as opaque sequences of bytes. There is no harm that the said bytes can do to your server as long as you do not try to "interpret" these bytes. Unfortunately, some operating systems are quite eager to interpret file contents, triggering heavy processing without explicit user consent; and that processing could have ...


2

Add the following 2 lines to your /etc/ssh/ssh_config and the /etc/ssh/sshd_config file: Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc MACs hmac-sha1 Restart services. Boom. FIPS compliant.


2

All this is indicating is that the process listening on that address and port has 'requested' the ability to receive connections from any IP address on any port. Until a connection is made the process appears as being connected to nothing in this way (asterisk). From the netstat manpage: Foreign Address - The IP address and port number of the remote ...


2

The short answer is "Yes, anything is possible." The long answer is "Maybe, but without more information it's virtually impossible to tell." You should consider that CentOS VM compromised, remove it from your network and also check the logs on any other systems that were online / connected at the time the unauthorized access occurred. First, here's ...


2

You can limit connections by network blocks, e.g. choose a size such as a C class (256 IPs) and then limit each C class connecting to you to say 10 connection per block of IPs. Unless an attacker is on the same C class as you (unlikely) then you will be able to connect still. To do this use the "--connlimit-mask" option, explained in: http://ipset.netfilter....


2

I am somewhat suspicious of your diagnosis of the cause of freezes, however if this is the case, then the question is off topic here and my first choice for a remedial action would be to look for a different hosting service(or asking the people who provide the current service to resolve the problem). Yes, Linux has limited rate management facilities within ...



Only top voted, non community-wiki answers of a minimum length are eligible