LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 06-23-2004, 04:18 AM   #1
td0l2
Member
 
Registered: Jun 2004
Location: Hong Kong
Distribution: debian
Posts: 32

Rep: Reputation: 15
I suspect my linux server is hacked. What should i do ??


I suspect that my linux server (redhat 7.2) is hacked. The root pwd is changed, ps command displays "segmentation fault", w cmd shows no user but i have been login one console.

I use the old kernel ( 2.4.18-xx) because trendmicro must use this old kernel version.

What should i do ??
 
Old 06-23-2004, 04:33 AM   #2
Axo
Member
 
Registered: May 2003
Distribution: Debian
Posts: 142

Rep: Reputation: 16
I'm no sercurity expert, but i would start with unSpawn's sticky at the top of this forum.
Found here


Edit: Wrong url

Last edited by Axo; 06-23-2004 at 04:44 AM.
 
Old 06-23-2004, 05:43 AM   #3
fluppi
Member
 
Registered: Oct 2003
Location: Switzerland (Europe)
Distribution: OpenSuSE, RedHat, Knoppix, IRIX + MacOSX
Posts: 198

Rep: Reputation: 30
Disconnect it from the net, reboot from CDROM into rescue mode to reset the root password.

Have you other machines with the same passwords ?

Then look if files got changed.
To get sure it is no fault in the filesystem run fsck.
 
Old 06-23-2004, 06:33 AM   #4
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 47
If you believe your system is cracked, the only solution is to reformat and install the OS again. If you have time at hand, you can venture into finding how your system got cracked.

unspawn had commented in detail on a very recent hack-incident reported on this forum.

http://www.linuxquestions.org/questi...hreadid=181974

Although this may not directly relate to you, you can pick up pointers on how to go about getting back to normal.

If you just want your system up again, backup your important data (but be sure they are not affected by this incident) and reformat and reinstall the OS.
 
Old 06-23-2004, 09:37 PM   #5
td0l2
Member
 
Registered: Jun 2004
Location: Hong Kong
Distribution: debian
Posts: 32

Original Poster
Rep: Reputation: 15
Thanks all replies.
I don't know why someone can enter my server. The ports of server are blocked except 443, 80, 7010, 14942(trendmicro used). Also, this server is located in DMZ. How does someone hack my server ?? This is my second time for this situation !!

Moreover, i use chkrootkit to check my system in order to find "special " file but thers is no file found. Why ? Why ??
 
Old 06-23-2004, 10:07 PM   #6
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 47
try rkhunter too.

Again, read unSpawn's post - the one I pointed you to earlier on this post.

Changing the locations of a few files / renaming them is enough to hide from such rootkit checks.

do

#netstat -lpa
#lsof -P

to check whether there are unknown processes that are running.

Again you cannot be sure about the authenticity of the output of those commands as those commands may themselves been compromised.
 
Old 06-24-2004, 04:13 AM   #7
td0l2
Member
 
Registered: Jun 2004
Location: Hong Kong
Distribution: debian
Posts: 32

Original Poster
Rep: Reputation: 15
I have tried rkhunter but it fail to install into server.

I also try both "netstat -lpa " and "lsof -P" but i don' know how to detinguish which process is suspected.

my server is under production. i can't reinstall server until mid of July.

Whay should I do ??
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is my server hacked? kazjol Linux - Security 3 10-10-2004 12:09 PM
Server hacked cpanelskindepot Linux - Security 46 07-05-2004 06:19 PM
Linux server hacked on ISP- what questions should I ask? marianm Linux - Security 13 06-11-2004 10:05 PM
server hacked!?!?! vittibaby Linux - Security 1 03-27-2004 12:31 PM
Linux Server Hacked, Bandwidth Eating Machine... zerofocus Linux - Security 2 02-07-2004 09:22 PM


All times are GMT -5. The time now is 01:10 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration