Hi everyone,

Our department has a Redhat 7.0. for web server for several years. Recently, I was told the Linux pc used the whole bandwidth by sending a lot of packets on the network, so other computers (windows base) can not getting the internet. Once I pull out the network cable from Linux pc, other computers go back to normal.

I've already changed root's password. I deleted some accounts that look weird. I changed the ssh setting etc/hosts.deny "sshd:all:deny"
It seems worked for two months. But now the problem shows up again.

I have no idea what can I do now.
Is there any patch for Redhat 7.0 I can update?
How to check what patch I curretly have got?
How to see the ports traffic?
Really need help....thank you.

TBH, RH7 is so obsolete I'm not at all suprised https://secure.wikimedia.org/wikiped.../Red_Hat_Linux.
The only real soln is to move up to something modern like Centos https://secure.wikimedia.org/wikipedia/en/wiki/Centos which is a free version of RHEL https://secure.wikimedia.org/wikiped...terprise_Linux.
Seriously, RH7 cannot be made secure; there are no patches/updates being issued and have not been for many yrs.

Once someone has got in ... its really difficult to ensure security again. And you have to go through more elaborate steps than you just did. Instead ,as suggested, you could just upgrade to a more recent release. But while backing up be careful about the binaries and scripts that are setuid 0. Once a system is compromised its better removed form the network otherwise whole network might be compromised.

If your machine not an VM, then you have to check Duplex settings.

0 members found this post helpful.

Doing stuff like this is only putting bandages on a mortal wound. If the machine has been compromised, the bad guys have almost certainly put in backdoors so they can access it pretty much no matter what you do. Under normal circumstances, I would advise you to do an investigation as to how the bad guys got in, but in this case, RH7 is so ancient that any investigation would be futile since there is no way to fix any problems you might discover. Even if you mean Fedora 7, it would be pointless.

Probably your best approach is to keep it off the network, salvage any data (not binaries) you need, and then put a modern distro on the machine. And while you're at it, I would give some serious thought as to how you might monitor the health of the system. A HIDS like AIDE or Samhain would probably be a good idea at least.

Under no circumstances should you continue to use this machine without a new OS.

Moved: This thread is more suitable in Linux Security and has been moved accordingly to help your thread/question get the exposure it deserves.

This is bad (and pointless) advice.

A duplex problem will show up, whether or not the machine is a VM. However, unless specifically told, most NIC's and routers/swtiches will do auto-negotiate, to prevent duplexing problems. The OP clearly posted that they're using a VERY old OS, one with widely known security issues. An intrustion seems to have taken place (although that assumption is based on vague information), since after changing the root password and removing some 'weird' accounts, things were ok. None of those would have addressed a duplex issue.

1 members found this post helpful.

Just to give you an idea of how out of date RH7 is; it hit EOL(End Of Life) in 2003. There have been no offical patches or update since that time(over 7 years).

Once a machine has been compromised the only way to be certain that it is secure is to do a fresh install. Which in RH7's case will do you zero(0) good, as it will probably take under a half an hour for the intruder to break in again. RHEL(Red Hat Enterprise Linux) is the line that replaced RH and RHEL6 is the current release. Unfortuantely one must pay a subcription fee to access RHEL updates. Fortuanely Centos is RHEL with the proprietary bits (mostly logos) stripped out, but is free to download and update. They use RHEL source rpms to build it. Any book, information, software, or hardware that is for RHEL is also for Centos. Centos does lag behind RHEL on new releases by a couple of months, so I would expect Centos 6 to be released in Febuary(rough guess). Centos security updates are usually about two days behind RHEL. RHEL/Centos 5 still has over five years of support life (current is 5.5 with 5.6 due out this spring).

Whoever hacked your machine did you a favor. Its time to upgrade to a supported OS. And tighten security.

Thank you everyone....

Can I ask what you're going to do?

2 members found this post helpful.

Hi everyone,

I'm gonna do is setup a new server and then transfer the database and web pages from Redhat to the new one(maybe Windows 2003).


You know I'm obviously a linux beginner. The guy who setup Redhat is already gone. Therefore, I really need you guys' help.

1. I have all web page files eg. php and so on

2. I have no idea how to transfer the database,Mysql(could you give me steps?). Could you guys tell me where I can copy the database file? (I need the path)

3.Could you guys tell me what files and folders I have to copy?

Thanks a million.

That should be relatively straight forward to do. Just zip up the directories containing the files and move them to the web server root on the new machine. Once moved, you'll probably have to go through the config files for the web sites and tweak them to reflect any changes in the new environment (things like mysql users, passwords, paths).

Look into using the mysqldump command. That will create a sql file with all the information from the database and all the information needed to re-create the tables in the new database.
If you're just moving the web sites and databases, the above should do. Like I said, some messing with the website config files will probably be needed to get everything working again.

Obviously its your decision, but since this is a Linux site, I'd encourage you to look at CentOS or maybe Ubuntu Server as alternatives to forking out for a Windows license.

1 members found this post helpful.

First of all, I appreciate your help. What do you mean by "tweak them"? What kind of config files do I have to go through?

What if I don't know the database name when I'm going to mysqldump? How can I find the database name?

Sorry for asking maybe some stupid questions....Again thanks for your help....

In my experience, most PHP sites have some sort of file (usually with "config" or "configuration" in the name) that does things like stores passwords, paths to important directories and database info. I can't be more specific than that because it is likely every PHP web site does things differently. You're just going to have to do some digging into how your sites operate and hope that either they're "commercial" sites (like Joomla or Drupal) or that the author documented things decently. For example, I've used Moodle in the past, and it has a configuration file that not only has the access info for the MySQL database, but also pointers to the directories where students can upload/download documents. If I move that to another machine, those likely have to change.

If you can't figure out the database name from the site config file (it frequently is in there) you should be able to log into MySQL and use the show databases; command to list all the databases MySQL knows about.

No such thing as stupid questions, so fire away. However, if you have more, we may want to either start a new thread (I'd suggest the Server forum) or ask the mods to move this one out of Security since it is no longer a security issue.