Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started investigating. According to the logs, this was approximately one week after the successful intrusion.
I used to host a website for a friend which was based on the Joomla CMS. During investigations I realized the website was severely outdated and practically abandoned. As his domain and site was the primary target, I suspect the attackers exploited known bugs or security flaws in the software to upload their own scripts, mainly to send spam email.
I just learned that one big issue is in fact, that all websites have the same user. Once the hackers gained access, they could execute server-side commands with this user (which is "www-data").
I wouldn't mind if this would have only affected my friend's site, but unfortunately they created a script in one of the other domains (which up until that date only showed an empty index.html). The file is a variant of the PHP remote shell called WSO and is the main reason I am asking for help. Before I wipe and re-install my root server, I want to make sure this won't happen again and want to ask these questions:
- Apparently the hacker managed to install a php script outside the boundaries of the outdated/broken domain. How did he do that? Shouldn't nginx or php5-fpm have some sort of mechanism to prevent php scripts accessing directories outside of the current domain's root?
- I know that some CMSs like Joomla ask you whether you want to use the php mail() function or an SMTP server. How can I strictly prevent php from sending emails by mail() and only allow authenticated smtp?
- Is it possible to completely encapsulate the website of my friend, so that once a hacker manages to inject some script, it won't help him accessing any other website, let alone the file system of the server?
- What is the ISP way of restricting customers' scripts and email sending behavior? Is rate-limiting the sending of emails good enough?