Hi everyone,

I have a CentOs server with about 10 virtual hosts configured with Apache.

A few days ago, I realised my server has been compromised and a phishing page has been hidden in some of the website root directories. I deleted them, updated Plesk, changed all my passwords (SSH, FTP, ...). I do not have any wordpress or other script like this: the websites are plain html files or based on my own php framework. But the phising scripts keep coming back, and I have no idea how to understand where they are coming from.

I can't even find my ftp logs files, but when I check my apache logs, they are so many lines, I don't really know what to look for...

Could you give me some guidances on what I should do ? For the moment, I configured a cron task to remove the files every minute, but it's not a long term solution of course. I'd like to understand how those files keep being created. I'm also afraid that those hackers could do way more damage than that eventually.

Thanks in advance

Hi,
you can take a look to /var/log/secure
there are a lot of information about access to your server in these file.
Virtual hosts? Can anybody access remotely to virtual hosts? Some virtual machines have this option of configuration.
Every virtual hosts must be secure not only the real server (passwords, etc).
what software use? proftp?.
Sorry, but I don't know more options, at this moment with this information.

also check your apache logs

it is VERY VERY -VERY- easy to configure a VERY INSECURE server

also have a look at the SELinux security logs
/var/log/selinux/????

if SE has been DISABLED -- not good

then
reformat the drives and reinstall with a KNOWN!!!! GOOD CLEAN UNCOMPRESSED back up
-- if you have one --

if not
start from scratch with CentOS 7.0 and the current Apache then keep SE set to ENFORCING

Thanks for your answers.

Lookng at /var/log/secure and /var/log/messages, I realized they were accessing my server via an old ftp account I've created months ago. I used it with the www.net2ftp.com web-based ftp service. They probably stole the credentials through it.

I disable this account and it seems fine now.

Thank you for your time.

REINSTALL EVERYTINNG USING A KNOWN GOOD BACKUP FROM BEFORE THEY GOT ACCESS !!!!!


who KNOWS what THEY CHANGED

1 members found this post helpful.

It might be a good idea to run a rootkit hunter on that thing if you're not going to wipe it.

...but without making the --propupd mistake.

Only use that switch if you know that the utils are in a clean condition and the only time that you know that is when the software has just been installed and no one has had chance to introduce 'fixed-up' (hacked) versions (and, many people don't absolutely know that, but in your particular case you have very, very good reasons for doubting it).

Well, unless you re-install, of course. Then you've got a clean situation.