1

I am not sure if this may indicate a compromised server or if I'm just being paranoid.

While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for its also new domain name), Apache suddenly refused to restart, with the following message:

(99)Cannot assign requested address: AH00072: make_sock: could not bind to address 54.201.82.69:80
no listening sockets available, shutting down
AH00015: Unable to open logs
Action 'start' failed.
The Apache error log may have more information.

Lo and behold, Apache's ports.conf contained the following:

Listen 8080
Listen 54.201.82.69:80

Port 8080 was put there deliberately for testing, not very long before. The IP address followed by port 80 just appeared out of thin air. Upon investigation *.com.com resolves to this IP, which seems to be a host for malware.

On the other hand, it seems at least conceivable that some kind of script or automated process (maybe Webmin?) incorrectly resolved a hostname with an extra ".com" on the end and, for some bizarre reason, shoved it into ports.conf. Also, had this been maliciously inserted by an intruder, I have no idea what it would accomplish.

The only other program that should have messed with Apache's configuration was roundcube webmail, from an official repo. There is no one else with access to this server. The auth log shows a number of unsuccessful SSH log in attempts from various IPs, in the several hours that the server's been up, but no successful log ins other than my own.

I don't know if I should chalk this up to some strange configuration snafu or change all the passwords and start clean with a restrictive firewall.

1

Looking up the address in the ARIN database the following results are given:

NetRange:       54.192.0.0 - 54.207.255.255
CIDR:           54.192.0.0/12
NetName:        AMAZON-2011L
NetHandle:      NET-54-192-0-0-1
Parent:         NET54 (NET-54-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS16509
Organization:   Amazon Technologies Inc. (AT-88-Z)
RegDate:        2013-06-19
Updated:        2013-06-19
Ref:            http://whois.arin.net/rest/net/NET-54-192-0-0-1

OrgName:        Amazon Technologies Inc.
OrgId:          AT-88-Z
Address:        410 Terry Ave N.
City:           Seattle
StateProv:      WA
PostalCode:     98109
Country:        US
RegDate:        2011-12-08
Updated:        2014-10-20
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to 
identify the correct owner of the IP address at that point in time.
Ref:            http://whois.arin.net/rest/org/AT-88-Z

OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-266-4064 
OrgAbuseEmail:  
OrgAbuseRef:    http://whois.arin.net/rest/poc/AEA8-ARIN

OrgNOCHandle: AANO1-ARIN
OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-266-2187 
OrgNOCEmail:  
OrgNOCRef:    http://whois.arin.net/rest/poc/AANO1-ARIN

OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-266-4064 
OrgTechEmail:  
OrgTechRef:    http://whois.arin.net/rest/poc/ANO24-ARIN

NetRange:       54.200.0.0 - 54.203.255.255
CIDR:           54.200.0.0/14
NetName:        AMAZO-ZPDX6
NetHandle:      NET-54-200-0-0-1
Parent:         AMAZON-2011L (NET-54-192-0-0-1)
NetType:        Reallocated
OriginAS:       AS16509
Organization:   Amazon.com, Inc. (AMAZO-47)
RegDate:        2013-07-17
Updated:        2013-07-17
Ref:            http://whois.arin.net/rest/net/NET-54-200-0-0-1

OrgName:        Amazon.com, Inc.
OrgId:          AMAZO-47
Address:        EC2, EC2 1200 12th Ave South
City:           Seattle
StateProv:      WA
PostalCode:     98144
Country:        US
RegDate:        2011-05-10
Updated:        2014-10-17
Ref:            http://whois.arin.net/rest/org/AMAZO-47

OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-266-4064 
OrgAbuseEmail:  
OrgAbuseRef:    http://whois.arin.net/rest/poc/AEA8-ARIN

OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-266-4064 
OrgTechEmail:  
OrgTechRef:    http://whois.arin.net/rest/poc/ANO24-ARIN

OrgNOCHandle: AANO1-ARIN
OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-266-2187 
OrgNOCEmail:  
OrgNOCRef:    http://whois.arin.net/rest/poc/AANO1-ARIN

It's an amazon hosting service with 287(as of this time) domains hosted on that address. Reading the webmin installation page you must

Enter the same login credentials that you used to log in to your server via SSH. This user must have root privileges via sudo.

Webmin listens by default on port 10000:

https://server_IP_address:10000

It is possible that you installation was discovered by a crawler, and the authentication was bypassed(as the address is the public address of the given work station). Strangely, altering those configurations doesn't benefit any potential attacker. However, since the given address is not related to any utilities that you've used it is recommended that you reinstall and start clean. Optionally you can write an email to the abuse address above, and ask for details on traffic from that box to your own if possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.