2

My server was under heavy load around 400 and above. Here is the link of Server Fault question

I was able to see the rm command and xargs running in top output, in which I was the one and only user logged in.

I tried to Kill that process but that didn't work.

I tried to write an iptables rule to make a default policy to drop and allow only my IP to communicate, but before doing that iptables went missing. I installed it again but it showed:

FATAL: Could not load /lib/modules/2.6.32-5-vserver-amd64/modules.dep: No such file or directory iptables v1.4.14: can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded.

When I tried to shutdown the server, I was getting time out messages. Rebooting also didn't work.

Once load came down I performed a chrootkit scan and here is the result. It shows many missing modules and hidden files.

Searching for suspicious files and dirs, it may take a while... The
following suspicious files and directories were found:
/usr/lib/pymodules/python2.6/.path /usr/lib/pymodules/python2.7/.path
/usr/lib/node_modules/npm/.npmignore
/usr/lib/node_modules/npm/.travis.yml
/usr/lib/node_modules/npm/node_modules/fast-list/.npmignore
/usr/lib/node_modules/npm/node_modules/fast-list/.travis.yml
/usr/lib/node_modules/npm/node_modules/fstream/.npmignore
/usr/lib/node_modules/npm/node_modules/fstream/.travis.yml
/usr/lib/node_modules/npm/node_modules/graceful-fs/.npmignore
/usr/lib/node_modules/npm/node_modules/lru-cache/.npmignore
/usr/lib/node_modules/npm/node_modules/minimatch/.travis.yml
/usr/lib/node_modules/npm/node_modules/node-uuid/.npmignore
/usr/lib/node_modules/npm/node_modules/nopt/.npmignore
/usr/lib/node_modules/npm/node_modules/slide/.npmignore
/usr/lib/node_modules/npm/node_modules/tar/.npmignore
/usr/lib/node_modules/npm/node_modules/tar/.travis.yml
/usr/lib/node_modules/npm/node_modules/.bin
/usr/lib/node_modules/npm/test/packages/npm-test-files/.npmignore
/usr/lib/node_modules/npm/test/packages/npm-test-ignore/.npmignore
/usr/lib/node_modules/npm/node_modules/.bin

Checking `lkm'... You have 3086 process hidden for readdir command SIGINVISIBLE Adore found chkproc: Warning: Possible LKM Trojan installed

Do I need to investigate further to confirm that it was an attack?

How can I get details about the way attacker got in?

5
  • 1
    My initial feeling is that these are false positives. Google each and every to make a qualified guess, shut down the server if needed meanwhile.
    – 3molo
    Aug 14, 2012 at 10:14
  • 1
    Is there any process in D state: ps aux | awk '$8 ~ /D/ { print $0 }'?
    – quanta
    Aug 14, 2012 at 10:43
  • now there is no process,but earlier it was there...
    – ananthan
    Aug 14, 2012 at 10:45
  • @quanta how can the iptables miss all of a sudden..just a moment earlier i checked iptables rules and the next moment.iptables command was missing...
    – ananthan
    Aug 14, 2012 at 10:47
  • I would update your kernel and iptables version before I do anything else. Your kernel is extremely old.
    – user167709
    Apr 3, 2013 at 20:22

1 Answer 1

0

It appears that chkrootkit doesn't like your Node.js installation since it has a large number of hidden files. Most of those look normal for a Node installation to me, though. The Python ones don't look normal, but that could just be because you're using Debian. Check into those.

As for the iptables problem, you are at the mercy of your VPS provider there. Since OpenVZ and Linux-VServer use a shared kernel, you can only use iptables if the provider loads it for you. In particular, Linux-VServer has very limited or no support for iptables in guest containers.

I hope that by now you have moved away from that crappy OpenVZ based VPS that you were on. That's certainly the root cause of all the problems you have been having.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .