I have CentOS 7 VPS and when I entered lsof -i command I've seen some strange connection:

sshd    26422   root    3r  IPv4 1081208      0t0  TCP jabber.darkserver.in:ssh->89-64-44-49.dynamic.chello.pl:31675 (ESTABLISHED)

I've checked this site (jabber.darkserver.in) and there was only default page from Microsoft IIS server. When I tried to block this connection with iptables I was disconected from my server, but then I could reconnect which possibly means that iptables were flushed. When I killed process I was disconnected too. May it be some backdoor? If yes, then what should I do? Would be removing it enough, or should I ask my VPS provider to format, and restart my server?

  • There is absolutely nothing known about your system and its setup which let us decide what is expected behavior and what not and thus if this connection is a problem or not. – Steffen Ullrich Dec 7 '18 at 17:58
  • I am only running sshd on it, this is newly set up server. – xoreaxeax Dec 7 '18 at 18:09
  • In this case it looks very strange for me, especially since the connection seems to originate from a SSH port and goes to some high number port on (what I guess is) your system - usually it should be the other way around. Given that the server is just a newly setup server anyway I would recommend to reinstall the system from a known good image - maybe the image you've used has a backdoor in it. – Steffen Ullrich Dec 7 '18 at 18:18
  • System was instaled by vps provider. The sshd version isn't up to date, so it is possible that it was infected by exploits. Also this host darkserver.in looks strange, and has unclear whois record. Would be good idea to ask my provider to ban it from his servers? – xoreaxeax Dec 7 '18 at 18:23
  • You should at least check if the new install exhibits the same problem. I also doubt that an attack was done because of an old version of sshd - they are usually fairly solid and have only issues with unusual configurations or hard to exploit issues. More likely is a weak SSH password - there are lots of brute force attacks against SSH logins. – Steffen Ullrich Dec 7 '18 at 18:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.