LinuxQuestions.org - sshd attacks

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - sshd attacks - failed passwords (https://www.linuxquestions.org/questions/linux-security-4/sshd-attacks-failed-passwords-493240/)

sshd attacks - failed passwords

My name is Jason Lim and I am an Administrator (or, rather, co-Administrator) of a forum that is rather large. Recently, we were disconnected from our webhost because of "unsolicited attacks". It appears that our server has been attacking our webhost (sounds funny, eh?). They allowed us the ability to secure it, but I have no idea how.

Neither I nor one of my peers have direct access to the server, so we cannot run remote commands. However, I would appreciate any help.

Here is a log of what our webhost sent me:

Oct 15 07:41:16 localhost sshd[15184]: Failed password for root from ***.***.***.*** port 41501 ssh2
Oct 15 07:41:19 localhost sshd[15186]: Failed password for root from ***.***.***.*** port 41834 ssh2
Oct 15 07:41:22 localhost sshd[15188]: Failed password for root from ***.***.***.*** port 43369 ssh2
Oct 15 07:41:24 localhost sshd[15191]: Failed password for invalid user admin from ***.***.***.*** port 45955 ssh2
Oct 15 07:41:26 localhost sshd[15193]: Failed password for invalid user test from ***.***.***.*** port 47823 ssh2
Oct 15 07:41:28 localhost sshd[15195]: Failed password for invalid user guest from ***.***.***.*** port 50122 ssh2
Oct 15 07:41:30 localhost sshd[15197]: Failed password for invalid user webmaster from ***.***.***.*** port 52199 ssh2
Oct 15 07:41:33 localhost sshd[15199]: Failed password for mysql from ***.***.***.*** port 53423 ssh2
Oct 15 07:41:35 localhost sshd[15201]: Failed password for invalid user oracle from ***.***.***.*** port 54223 ssh2
Oct 15 07:41:37 localhost sshd[15204]: Failed password for invalid user library from ***.***.***.*** port 54353 ssh2
Oct 15 07:41:39 localhost sshd[15206]: Failed password for invalid user info from ***.***.***.*** port 54519 ssh2
Oct 15 07:41:41 localhost sshd[15208]: Failed password for invalid user shell from ***.***.***.*** port 54691 ssh2
Oct 15 07:41:43 localhost sshd[15210]: Failed password for invalid user linux from ***.***.***.*** port 54824 ssh2
Oct 15 07:41:45 localhost sshd[15212]: Failed password for invalid user unix from ***.***.***.*** port 55001 ssh2
Oct 15 07:41:47 localhost sshd[15214]: Failed password for invalid user webadmin from ***.***.***.*** port 55138 ssh2
Oct 15 07:41:49 localhost sshd[15216]: Failed password for ftp from ***.***.***.*** port 55271 ssh2
Oct 15 07:41:51 localhost sshd[15218]: Failed password for invalid user test from ***.***.***.*** port 55437 ssh2
Oct 15 07:41:54 localhost sshd[15221]: Failed password for root from ***.***.***.*** port 55639 ssh2
Oct 15 07:41:57 localhost sshd[15223]: Failed password for invalid user admin from ***.***.***.*** port 55816 ssh2
Oct 15 07:41:58 localhost sshd[15225]: Failed password for invalid user guest from ***.***.***.*** port 56036 ssh2
Oct 15 07:42:00 localhost sshd[15227]: Failed password for invalid user master from ***.***.***.*** port 56159 ssh2
Oct 15 07:42:02 localhost sshd[15229]: Failed password for apache from ***.***.***.*** port 56330 ssh2
Oct 15 07:42:04 localhost sshd[15231]: Failed password for root from ***.***.***.*** port 56480 ssh2
Oct 15 07:42:06 localhost sshd[15233]: Failed password for root from ***.***.***.*** port 56630 ssh2
Oct 15 07:42:09 localhost sshd[15236]: Failed password for invalid user network from ***.***.***.*** port 56807 ssh2
Oct 15 07:42:11 localhost sshd[15238]: Failed password for invalid user word from ***.***.***.*** port 56991 ssh2
Oct 15 07:42:13 localhost sshd[15240]: Failed password for root from ***.***.***.*** port 57167 ssh2
Oct 15 07:42:15 localhost sshd[15242]: Failed password for root from ***.***.***.*** port 57323 ssh2
Oct 15 07:42:17 localhost sshd[15244]: Failed password for root from ***.***.***.*** port 57506 ssh2
Oct 15 07:42:19 localhost sshd[15246]: Failed password for root from ***.***.***.*** port 57648 ssh2
Oct 15 07:42:21 localhost sshd[15248]: Failed password for root from ***.***.***.*** port 57839 ssh2
Oct 15 07:42:24 localhost sshd[15251]: Failed password for root from ***.***.***.*** port 58001 ssh2
Oct 15 07:42:26 localhost sshd[15253]: Failed password for root from ***.***.***.*** port 58173 ssh2
Oct 15 07:42:27 localhost sshd[15255]: Failed password for root from ***.***.***.*** port 58350 ssh2
Oct 15 07:42:29 localhost sshd[15257]: Failed password for invalid user text from ***.***.***.*** port 58951 ssh2
Oct 15 07:42:31 localhost sshd[15259]: Failed password for invalid user book from ***.***.***.*** port 59087 ssh2
Oct 15 07:42:34 localhost sshd[15261]: Failed password for invalid user choil from ***.***.***.*** port 59666 ssh2
Oct 15 07:42:36 localhost sshd[15263]: Failed password for invalid user jarid from ***.***.***.*** port 59848 ssh2
Oct 15 07:42:38 localhost sshd[15266]: Failed password for root from ***.***.***.*** port 59999 ssh2
Oct 15 07:42:39 localhost sshd[15268]: Failed password for root from ***.***.***.*** port 60587 ssh2
Oct 15 07:42:41 localhost sshd[15270]: Failed password for root from ***.***.***.*** port 60713 ssh2
Oct 15 07:42:44 localhost sshd[15272]: Failed password for root from ***.***.***.*** port 60851 ssh2
Oct 15 07:42:46 localhost sshd[15274]: Failed password for root from ***.***.***.*** port 33204 ssh2
Oct 15 07:42:47 localhost sshd[15276]: Failed password for root from ***.***.***.*** port 33358 ssh2
Oct 15 07:42:49 localhost sshd[15278]: Failed password for invalid user admin from ***.***.***.*** port 33854 ssh2
Oct 15 07:42:51 localhost sshd[15280]: Failed password for invalid user admin from ***.***.***.*** port 34028 ssh2
Oct 15 07:42:53 localhost sshd[15283]: Failed password for invalid user admin from ***.***.***.*** port 34191 ssh2
Oct 15 07:42:55 localhost sshd[15285]: Failed password for invalid user admin from ***.***.***.*** port 34759 ssh2
Oct 15 07:42:57 localhost sshd[15287]: Failed password for root from ***.***.***.*** port 34915 ssh2
Oct 15 07:42:59 localhost sshd[15289]: Failed password for root from ***.***.***.*** port 35446 ssh2
Oct 15 07:43:01 localhost sshd[15291]: Failed password for invalid user test from ***.***.***.*** port 35605 ssh2
Oct 15 07:43:03 localhost sshd[15293]: Failed password for invalid user test from ***.***.***.*** port 35760 ssh2
Oct 15 07:43:05 localhost sshd[15376]: Failed password for invalid user webmaster from ***.***.***.*** port 36296 ssh2
Oct 15 07:43:08 localhost sshd[15451]: Failed password for invalid user user from ***.***.***.*** port 36445 ssh2
Oct 15 07:43:09 localhost sshd[15453]: Failed password for invalid user username from ***.***.***.*** port 36951 ssh2
Oct 15 07:43:11 localhost sshd[15455]: Failed password for invalid user username from ***.***.***.*** port 37125 ssh2
Oct 15 07:43:13 localhost sshd[15457]: Failed password for invalid user user from ***.***.***.*** port 37259 ssh2
Oct 15 07:43:15 localhost sshd[15459]: Failed password for root from ***.***.***.*** port 37815 ssh2
Oct 15 07:43:18 localhost sshd[15461]: Failed password for invalid user admin from ***.***.***.*** port 37988 ssh2
Oct 15 07:43:20 localhost sshd[15463]: Failed password for invalid user test from ***.***.***.*** port 38545 ssh2
Oct 15 07:43:21 localhost sshd[15466]: Failed password for root from ***.***.***.*** port 38706 ssh2
Oct 15 07:43:23 localhost sshd[15468]: Failed password for root from ***.***.***.*** port 38823 ssh2
Oct 15 07:43:26 localhost sshd[15470]: Failed password for root from ***.***.***.*** port 39389 ssh2
Oct 15 07:43:28 localhost sshd[15472]: Failed password for root from ***.***.***.*** port 39561 ssh2
Oct 15 07:43:30 localhost sshd[15474]: Failed password for invalid user danny from ***.***.***.*** port 40120 ssh2
Oct 15 07:43:32 localhost sshd[15476]: Failed password for invalid user sharon from ***.***.***.*** port 40276 ssh2
Oct 15 07:43:34 localhost sshd[15478]: Failed password for invalid user aron from ***.***.***.*** port 40857 ssh2
Oct 15 07:43:36 localhost sshd[15480]: Failed password for invalid user alex from ***.***.***.*** port 43764 ssh2
Oct 15 07:43:38 localhost sshd[15483]: Failed password for invalid user brett from ***.***.***.*** port 43933 ssh2
Oct 15 07:43:40 localhost sshd[15485]: Failed password for invalid user mike from ***.***.***.*** port 44507 ssh2
Oct 15 07:43:43 localhost sshd[15487]: Failed password for invalid user alan from ***.***.***.*** port 44647 ssh2
Oct 15 07:43:45 localhost sshd[15489]: Failed password for invalid user data from ***.***.***.*** port 45225 ssh2
Oct 15 07:43:47 localhost sshd[15491]: Failed password for invalid user www-data from ***.***.***.*** port 45386 ssh2

Where ***.***.***.*** is our forum's IP address.

The server is a dedicated server, whatever that means.

If anyone has any advice, I would be extremely grateful.

Also, I am a Linux newbie, so please keep the information as simple as possible.

Looks like your server has been hacked and your ISP would be right to disconnect it.

Someone needs to be responsible for keeping the server's operating system and forum software up-to-date with security patches and apply good security practice.

You should be paying someone to do that. Your host may just be renting you the server and assume you're managing it yourself, in which case it's your responsibility. If you're paying your host to keep it secure and forum software up-to-date then it's their problem.

As you don't know the root SSH password you cannot do this maintenance yourself so I'm assuming your webhost has responsibility for this. You would therefore have a right to expect them to deal with this problem. Frankly the best solution is for them to install and secure a new server and then copy over your data.

Gary

Quote:

Originally Posted by gstimson

OK, I'm not too familiar with webhost terminology, so...

I am one of 4 Administrators on this forum, but being disorganised idiots as we are, despite the fact we are supposedly able to execute remote commands, I can't, for some reason. But one of us is the owner of the site, the domain name and the server. The server is a dedicated server run by our webhost aplus.net - and I guess it means the responsibility falls on all 4 of us. :(

Alright, we did manage to connect to SSH (but that was my fellow Administrator and he is off now). Is there anything we can do? It's not root access, but I assume it is quite high up.

And, just to confirm, what do you think the odds that we are definitely hacked is? I am in contact with our webhost at the moment, and would like to ascertain what our, er, poor chances are. :(

Quote:

Originally Posted by x42bn6

Alright, we did manage to connect to SSH (but that was my fellow Administrator and he is off now). Is there anything we can do? It's not root access, but I assume it is quite high up.

To continue using that server you'd need to remove any dodgy stuff installed by a hacker, secure the server and update and secure the forum.

Quote:

Originally Posted by x42bn6

And, just to confirm, what do you think the odds that we are definitely hacked is?

The SSH log you posted looks pretty certain to me.

No offence, but you're probably best off running the forum and leaving someone else to manage the forum software and server security. Some companies provide hosted forums and would assist you in migrating. Your monthly cost would likely be higher because someone has to pay the people to do the maintenance.

Gary

Quote:

Originally Posted by gstimson

To continue using that server you'd need to remove any dodgy stuff installed by a hacker, secure the server and update and secure the forum.

The SSH log you posted looks pretty certain to me.

No offence, but you're probably best off running the forum and leaving someone else to manage the forum software and server security. Some companies provide hosted forums and would assist you in migrating. Your monthly cost would likely be higher because someone has to pay the people to do the maintenance.

Gary

Alright, thanks. I have a very good idea who the hacker was - one certain user "deadlock" appeared when we executed last -a and he is most likely the culprit...

I just wish I knew Linux better...

Thank you for your help once again. I'll get my superior to get the job done.

Hey guys, thanks for the help so far. I'm another admin over at the forums, and I do have SSH access..so I can execute remote commands.

I run linux as a desktop, and have for a few years now..but still, my sever knowledge is some-what limited.

However, I actually have been updating our server via yum. Right now we run FC4 as our server OS, and we are up-to-date -- this means patches and everything.

I'm not sure if that changes anything, but I figured I should add that.

-roach

Quote:

Originally Posted by gstimson

Server has been hacked? These look like failed attempts to me..

Am I confused on something?

I'm no server-whiz, but the above simply looks like someone trying to guess the password to the SSH server (possibly trying to crack it with a program). However, ANYONE can connect to an SSH server remotely with a username and password..just like FTP. Am I right so far? If someone decided to type our host address into their ftp client, and go on a password guessing spree, how exactly is that our problem or responsibility? Anyone can do this...and you can't prevent failed hacking attempts.

I get those messages in my logs all the time. It's due to hackers trying to log into your ssh server. I've fixed it using the script at blinkeye.ch/mediawiki/index.php/SSH_Blocking (this forum won't allow me to post urls - I'm sure you know what to do!

I created an init script that starts it when my machine boots up. It blocks attempts to get onto your sever for 10 minutes if there have been more than 6 unsuccesful attempts at loggin in. You might need to make a few modifications to it. You need iptables installed.

If I'm reading the OP correctly, the log he posted is from a different server. Those are ssh login attempts originating from his server, not trying to get into his server.

If you need ssh, and have the ability to change the ssh configuration (not always possible with some hosting solutions), consider changing ssh to run on a port other than 22, e.g. 3456, and/or restricting the IPs which can connect to the ssh port to a list of IPs you know only you have access to.

hmm I'm not a linux security guru by any means, but afaik if a server has been compromised it's usually best practice to backup all of your data files and do a reinstall of the os. The reason being that you have no idea what the intruder did when they gained access. Yes you know that they tried to launch an attack on your isp, there's also a good chance he/she's setup a backdoor into your system. Changing passwords and ssh config may not be enough at this point. Best practice would be to back up your data, have aplus.net reinstall the os, install tripwire right away, thoroughly lock down any remote login access, then reload your data from your archives. It sounds like a lot but you could probably knock it all out in one night. Just post a message on your forum saying that "we will temporarily be offline for scheduled maintenance from 10pm - 6am".

I just re-read the thread a little more carefully... These ssh login attempts are coming FROM your server...

Looks like someone at least has a shell on your machine.

This page has some very good advice.

Be aware that the only way to be 100% sure the machine is clean is to re-install the OS, but you can't do this over the net, at least not without the host-co's help.

Search your forum software maker's page, security advisory sites and hacking sites like milw0rm to help identify the flaw which led to the compromise. I mention milw0rm specifically because it helped identify an attack on one of my sites in the past, and it's often got info there before it gets published on the software vendor's site or security sites.

Quote:

Originally Posted by x42bn6

some hacker wud leave those traces..or maybe he want's to make sure you know u r hacked ;)

there is a topic made sticky why not read it...

http://www.linuxquestions.org/questi...d.php?t=340366

Quote:

Originally Posted by ~=gr3p=~

some hacker wud leave those traces..or maybe he want's to make sure you know u r hacked ;)

there is a topic made sticky why not read it...

http://www.linuxquestions.org/questi...d.php?t=340366

Reading that link is going to do absolutely no good because the OP was the SOURCE of the ssh attack, not the vicitm. The OP needs to take steps to determine how the box was compromised and what was done to it. And since we haven't had any new information for a bit, it is pretty useless to sit and speculate.

Quote:

Originally Posted by matthewg42

Right, I can run remote commands but not sure if I am root. Are there any commands I suggest I run? I'll post what they give here.

[edit] Here is a snippet from last -a -d:

anon ftpd24200 Wed Oct 11 11:54 - 12:00 (00:05) anonland
anon ftpd23050 Tue Oct 10 11:47 - 11:52 (00:05) anonland
amantis pts/1 Tue Oct 10 06:51 - 06:57 (00:05) 86.126.25.217
amantis pts/0 Tue Oct 10 01:02 - 06:57 (05:54) 86.126.25.217
amantis pts/0 Mon Oct 9 03:28 - 08:35 (05:07) 86.126.25.217
amantis pts/0 Sun Oct 8 09:53 - 11:31 (01:38) 86.126.25.217
amantis pts/0 Sun Oct 8 05:29 - 05:31 (00:02) 86.126.25.217
amantis pts/1 Sun Oct 8 05:04 - 05:29 (00:24) 86.126.25.217
amantis pts/0 Sun Oct 8 03:27 - 05:05 (01:38) 86.126.25.217
amantis pts/0 Sat Oct 7 06:04 - 13:14 (07:09) 86.126.25.217
anon ftpd26087 Fri Oct 6 20:46 - 20:46 (00:00) anonland
anon ftpd26088 Fri Oct 6 20:46 - 20:46 (00:00) anonland

"Amantis" was a former Administrator on this forum (and she holds no grudges). The IP address is banned by SORBS, and does not match her any of her IP addresses on our forum IP checking facility. We are deleting the account (if not done so already).

Are there any commands to block that IP address? Or perhaps any other suggested commands?

Quote:

Right, I can run remote commands but not sure if I am root. Are there any commands I suggest I run? I'll post what they give here.

I still think the best suggestion is to back up your data, have aplus.net reload the OS, and then start from scratch. Once your server has been compromised you can never be certain as to what the intruder did while they were in. Once the os is reloaded setup tripwire and read some docs on how to secure ssh. For example, use strong passwords, use the Allowed Users parameter and set root login to no.

Quote:

Originally Posted by Hangdog42

If I'm reading the OP correctly, the log he posted is from a different server. Those are ssh login attempts originating from his server, not trying to get into his server.

Ok, now I get it. That is very odd.

However, what if the SSH attempts were coming from webmin? Would that show that they were executed from OUR server?

Quote:

Originally Posted by RoaCh Of DisCor

Ok, now I get it. That is very odd.

However, what if the SSH attempts were coming from webmin? Would that show that they were executed from OUR server?

Quote:

Originally Posted by x42bn6

Are there any commands to block that IP address? Or perhaps any other suggested commands?

May I point out that at this point you have no idea how your server was compromised, or even if it was compromised. I would suspect that the ssh script doesn't take root access to run, so it is possible that one of your approved users ran it, or your forum was compromised and the script run as the Apache user. Certainly the wipe and reinstall that msound has suggested is the only way to be certain your box is clean. However, you would need to make sure everything is upgraded and patched since doing that wipes out any chance of figuring out how the compromise took place. May I suggest that someone with root access start looking here for some ideas on where to go next.

Quote:

Originally Posted by Hangdog42

My guess is that they would show as executed by the server Webmin is running on. However, I've never used Webmin for SSH access so I may be wrong about that. The one thing to keep in mind is that the log file in the original post very much resembles the kind of automated SSH attack that everyone sees. Given that log, I would not suspect someone using Webmin but rather a script.

May I point out that at this point you have no idea how your server was compromised, or even if it was compromised. I would suspect that the ssh script doesn't take root access to run, so it is possible that one of your approved users ran it, or your forum was compromised and the script run as the Apache user. Certainly the wipe and reinstall that msound has suggested is the only way to be certain your box is clean. However, you would need to make sure everything is upgraded and patched since doing that wipes out any chance of figuring out how the compromise took place. May I suggest that someone with root access start looking here for some ideas on where to go next.

I have a good idea that the account "Amantis" was compromised. I just spoke with her and confirmed she didn't log into Webmin recently, so it must have been a hacker.

We aren't going to reinstall until our webhost replies again later, and definitely not if not required. I do have a good feeling about this, though. If we get any more issues, then I will post here again.

I would caution against a premature declaration of victory here. If you suspect the Amantis account was compromised, it is possible you'll see evidence in the .bash_history file of what was done. It certainly can't hurt to look and see. Also, assuming your right about the compromised account, there is the question of how it was compromised. A little shoulder surfing? Insecure password? Cracked software?

I'm also a touch confused about how Webmin plays into this. In most of the threads, it sounds like you are using SSH to access the server. However, if you are running Webmin on that server and accessing through that, you may have more trouble. Webmin is often run with root privileges so if that was the way they got in, they may have had root access.

I thought aplus.net used a web administration package called Plesk on their dedicated servers...

Quote:

Originally Posted by Hangdog42

I know what you mean - I logged into Webmin as root and got the command shell as root too...

Here is .bash_history: can't see anything bad, though. But my guess was insecure password.

> more .bash_history
::::::::::::::
.bash_history
::::::::::::::
ifconfig
top
chkconfig
chkconfig--list
chkconfig --list
chkconfig
chkconfig --level 1
chkconfig --level 2
chkconfig --level 3
chkconfig --level
chkconfig --list | more
chkconfig
chkconfig --level 0123456 xinetd off
chkconfig --list | more
chkconfig --level 0123456 xfs off
chkconfig --level 0123456 netfs off
chkconfig --level 0123456 pcmcia off
chkconfig --level 0123456 rpcgssd off
chkconfig --list | more
chkconfig --level 0123456 rpcidmapd off
chkconfig --level 0123456 rpcsvcgssd off
chkconfig --list | more
chkconfig --level 0123456 mdmonitor off
chkconfig --level 0123456 portmap off
chkconfig --level 0123456 isdn off
chkconfig --list | more
chkconfig --list | more
chkconfig --level 0123456 nfslock off
chkconfig --list | more
chkconfig --list | more
chkconfig --level 0123456 cups off
chkconfig --level 0123456 readahead off
chkconfig --level 0123456 readahead_early off
chkconfig --level 0123456 gpm off
chkconfig --level 0123456 haldaemon off
chkconfig --list | more
sync
reboot
vi /etc/hosts
vi /etc/sysconfig/network
vi /etc/sysconfig/network-scripts/ifcfg-eth0
sync
reboot
top
ls
pwd
chkconfig --list | more
ifconfig
ping cox.net
ping cox.net
exit
top
netstat -ant
netstat -ant
top
netstat -ant
exit
ping cox.net
top
netstat -ant
netstat -ant
netstat -ant
netstat -ant
netstat -ant
netstat -ant
netstat -ant
vi /etc/sysconfig/rhn/sources
up2date -uf
rpm --import /usr/share/rhn/RPM-GPG-KEY
rpm --import /usr/share/rhn/RPM-GPG-KEY-fedora
up2date -uf
up2date -uf
netstat -ant
netstat -an
service iptables stop
up2date -uf
vi /etc/sysconfig/network-scripts/ifcfg-eth0
service network restart
netstat -ant
service iptables start
netstat -ant
up2date -uf
up2date -uf
sync
reboot
sync
halt
chkconfig --list | more
chkconfig --level 0123456 apmd off
chkconfig --level 0123456 rhnsd off
chkconfig --list | more
chkconfig --level 0123456 mDNSResponder off
chkconfig --list | more
chkconfig --level 0123456 nifd off
chkconfig --list | more
chkconfig --list | more
ping cox.net
vi /etc/sysconfig/iptables
vi /etc/hosts
sync
reboot
sync
halt
vi /etc/cron.monthly/up2date.cron
chmod 755 /etc/cron.monthly/up2date.cron
sync
halt
ping yahoo.com
vi /etc/selinux/config
rm -f /etc/ssh/ssh_host_*
vi /etc/sysconfig/network
vi /etc/sysconfig/network-scripts/ifcfg-eth0
ls
ftp 216.55.169.170
halt
passwd
vi /etc/hosts
vi /etc/sysconfig/network
vi /etc/sysconfig/network-scripts/ifcfg-eth0
vi /etc/hosts
rm -f /etc/ssh/ssh_host_*
reboot
ping yahoo.com
setup
service network restart
ping yahoo.com
halt
ftp 216.55.169.170
ls
rpm ?
rpm webmin-1.220-1.noarch.rpm
rpm zxbf webmin-1.220-1.noarch.rpm
exit
yum install webmin
yum search webmin
wget http://internap.dl.sourceforge.net/s...0-1.noarch.rpm
ls
rpm -ihv webmin-1.230-1.noarch.rpm
vi /etc/sysconfig/iptables
/etc/init.d/iptables restart
ls
rm webmin-1.2*
ls
yum upgrade
ls
cd /
cd /etc
vi proftpd.conf
cd ssh
vi sshd_conf
ls
vi sshd_coningf
vi sshd_confing
vi sshd_config
ls /var
iptables --list
php
locate php
updatedb
locate php
yum install php5
rpmfind
locate find
php
locate php
apachectl -t
apachectl
locate apachectl
cd /usr/sbin
apachectl
./apachectl
./apachectl -t
nano
nano /etc/httpd/conf/httpd.include
nano /etc/httpd/conf/httpd.conf
./apachectl -t
nano /etc/httpd/conf/httpd.conf
./apachectl -t
locate php.so
locate php4
exit
cd /etc
vi php.ini
service httpd restart
cd httpd
cd conf
ls
vi httpd.conf
service httpd restart
vi httpd.conf
service httpd restart
cd /var/www
ls
cd battlenetwork/
ls
cd ook
ls
more index.php
cdd includes
cd includes
ls
vi config.php
cd /var/log/httpd
ls
tail -f access_log
ls
tail -f error_log
php -i
cd /var/www
ls
ls -alh
cd battlenetwork/
ls
cd ook
ls
ls -alh
more Warn.php
more .htaccess
cdc /etc
cd /etc/httpd/conf
ls
vi httpd.conf
vi httpd.conf
ls
ls
ls
php --help
rpm -ql php
rpm -ql php |more
httpd
httpd -L
httpd -L | grep php
yum search php
yum search php |more
yum search php
yum search php | grep php
yum install mod_php
rpm -ql php
cd /usr/share/doc/php-4.3.11/
ls
more INSTALL
cdc /etc
cd /etc/httpd/conf
vi httpd.conf
service httpd restart
rpm -ql php
rpm -ql php |more
cd /etc/httpd/conf
vi httpd.conf
service httpd restart
service httpd restart
vi httpd.conf
ls
vi httpd.conf
exit
yum update
ls
exit
exit
cd /home/
ls
uname -a
updatedb
locate httpd.conf
vi /etc/httpd/conf/httpd.conf
cd /var/www/battlenetwork
ls
cd ook/
ls
vi index.php
vi /etc/php.ini
service httpd restart
vi /etc/httpd/conf/httpd.conf
vi /etc/httpd/conf/httpd.conf
locate httpd
service httpd restart
ls -al
cd install/
ls
cd ../
ls
vi includes/config.php
cd /var/lib/mysql/
ls
cd 1BfMaiN1
ls -al
cd ../
du -h 1BfMaiN1
cd 1BfMaiN1
du -h *
vi /var/www/battlenetwork/ook/includes/config.php
vi /etc/php.ini
service httpd restart
locate httpd
cd /var/log/httpd
ls
tail error_log
vi /etc/httpd/conf/httpd.conf
service httpd restart
cd /var/lib/mysql/
ls
du -h 1BfMaiN1
ls -al
cd /var/www/battlenetwork/
ls
vi test.php
ls -al
ls -al
cd ook/
ls
ls -al
cd ../
ls
ls -al
chown -Rh cr00k3d:cr00k3d ook/
tail /var/log/httpd/error_log
tail /var/log/messages
ls
cd ../
ls
cd cr00k3d/
ls
ls -al
cd ../
ls
cd battlenetwork/
ls -al
cd ook/
ls
vi index.php
ls
cd errorlog/
ls
cd ../
ls
cd archive/
ls
vi index.php
cd ../
mv index.php index.php.bak
cp archive/index.php index.php
vi index.php
cd ../
ls
cd ../
ls
cd BfMaiN/
ls
cd ../
ls
cd battlenetwork/
ls
cd ook/
ls
cd includes/
ls
cd ../
ls
cd in
cd install/
ls
mv install.php.renamed install.php
cd /var/lib/mysql/
ls
tar cvf 1BfMaiN1.bak.tar 1BfMaiN1/
ls
cd /var/www/
ls
cd battlenetwork/
ls
yum install ncftp
ncftp -u technik
ncftp -u technik 216.55.162.23
ftp 216.55.162.23
ncftp -u taylor void.gloom.org
ls
mv ook/ ook.bak/
mkdir mv vbulletin_3-0-3_15946fc1.zip ook.
ls
mkdir ook
cd mv/
ls
cd ..
rm -Rf mv
ls
mv vbulletin_3-0-3_15946fc1.zip ook/
cd ook/
ls
unzip vbulletin_3-0-3_15946fc1.zip
ls
cd upload/
ls
cd includes/
ls
mv config.php.new config.php.new
mv config.php.new config.php
vi config.php
ls -al
cd ../
cd install/
ls
cd /etc/yum.
cd /etc/yum.repos.d/
ls
yum upgrade
yum update
yum remove php
yum install php*
service httpd restart
yum remove php4_module
yum remove mod_php
yum remove mod_php4
yum install mod_php
rpm -qa | grep mod_
rpm -qa | grep php
locate httpd
locate httpd.conf
vi /etc/httpd/conf/httpd.conf
cd /var/www/
ls
cd battlenetwork/
ls
mv ook/ vbulliten_unzipped/
ls
mv ook.bak/ ook/
cd ook/
ls
vi index.php
mv index.php index.php.bak.2
mv index.php.bak index.php
ls
vi index.php
cd includes/
ls
ls -al
cd ../
ls
ls
cd /var/www/battlenetwork/
ls
cd ook
ls
cd ../
cd ook.bak/
ls
cd includes/
ls
vi config.php
cat config.php
q
w
ls
w
history
last
ls /var/www/
service psa stopall
w
history
/etc/init.d/webmin
/etc/init.d/webmin stop\
/etc/init.d/webmin stop
/etc/init.d/webmin start
/etc/init.d/webmin start
/etc/init.d/webmin restart
,ls
ls
locate webmin
exit
shutdown -h now

Quote:

Here is .bash_history: can't see anything bad, though.

You would be a better judge of what is normal on your machine than I would, but this strikes me as odd:

Quote:

chown -Rh cr00k3d:cr00k3d ook/

Is cr00k3d a user and group that is supposed to be on this box? Also, was this the .bash_history from root or from the Amantis account? If it is from the Amantis account, then I might actually worry more because of the lack of signs of the cracking.

Quote:

But my guess was insecure password.

You guys are doing a lot of guessing here, and that could land you right back into hot water. From what you've posted, here are what we know as facts:

1) Your box was fingered as the culprit in an SSH dictionary attack.
2) The Amantis account has logins that cannot be accounted for by the legitimate owner.

That's pretty much all we know as facts, unless you're not telling us everything. And that is not enough to diagnose how the intruder got access. If this is as far as you're willing to go, then you really need to reinstall the OS because you don't know what happened. You need to make sure everything is fully patched and you need to make sure that all passwords and SSH keys (if you use them) are changed. Otherwise you do need to do more digging to find out what actually happened.

Your call.

Quote:

Originally Posted by Hangdog42

You would be a better judge of what is normal on your machine than I would, but this strikes me as odd:

Is cr00k3d a user and group that is supposed to be on this box? Also, was this the .bash_history from root or from the Amantis account? If it is from the Amantis account, then I might actually worry more because of the lack of signs of the cracking.

You guys are doing a lot of guessing here, and that could land you right back into hot water. From what you've posted, here are what we know as facts:

1) Your box was fingered as the culprit in an SSH dictionary attack.
2) The Amantis account has logins that cannot be accounted for by the legitimate owner.

That's pretty much all we know as facts, unless you're not telling us everything. And that is not enough to diagnose how the intruder got access. If this is as far as you're willing to go, then you really need to reinstall the OS because you don't know what happened. You need to make sure everything is fully patched and you need to make sure that all passwords and SSH keys (if you use them) are changed. Otherwise you do need to do more digging to find out what actually happened.

Your call.

The giant post above you is .bash_history.

The problem is, reinstalling something like this is not going to be easy. Employing someone to fix this is beyond our financial means (most of us are still students).

We have banned a few IPs, disabled SSH, changed the root passwords, deleted Webmin accounts and chanaged ports... We can't find anything suspicious, .bash_history looks clean (cr00k3d is a known user)... We will keep digging, but if soomething happens, I (or we) will be back here.

Good Day

To check if your box has been compromised install, root kit hunter, can be found at www.rkhunter.nl, aslo to prevent this again use "DenyHost", it can be found at http://www.howtoforge.com/preventing...with_denyhosts . Works wonders for me and I can check who has tried a brute force SSH attack

Before anyone start suggesting things to "fix" this (which you shouldn't (yet)) I think you should start investigating in a more methodical way. Please read Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html and post anything anomalous here. If it's too much to post, tarball up the results, logs, whatever and provide a D/L location.

// I also would like to applaud those who ask questions, shun guessing, doubt the completeness of the "evidence" and the validity of it all. Only the inquisitive approach can yield the "right" results. Keep up the good work.

Quote:

Originally Posted by x42bn6

The giant post above you is .bash_history.

I know that. The question was which account it belonged to.

Quote:

Originally Posted by x42bn6

The problem is, reinstalling something like this is not going to be easy. Employing someone to fix this is beyond our financial means (most of us are still students).

That is certainly a concern, but you are going to have to weigh that against the possiblity that you haven't closed the door on the cracker and your computer is going to get pulled off the net again because its a platform for crackers.

Quote:

Originally Posted by x42bn6

We have banned a few IPs, disabled SSH, changed the root passwords, deleted Webmin accounts and chanaged ports...

All of which could be completely useless depending upon how the box was compromised. Which you don't know.

Quote:

Originally Posted by shawnbishop

To check if your box has been compromised install, root kit hunter, can be found at www.rkhunter.nl,

Good suggestion. That and chkrootkit would be a good thing to do.

Quote:

Originally Posted by shawnbishop

aslo to prevent this again use "DenyHost", it can be found at http://www.howtoforge.com/preventing...with_denyhosts . Works wonders for me and I can check who has tried a brute force SSH attack

Once again, these guys were not the victim of a brute force SSH attack, they were the source of it. They don't know how they were compromised.

root kit hunter, can be found at www.rkhunter.nl
No, we're at rkhunter.sourceforge.net.

Quote:

Originally Posted by unSpawn

root kit hunter, can be found at www.rkhunter.nl
No, we're at rkhunter.sourceforg.net.

rkhunter.sourceforge.net? ;)