2

I've just had an email from my hosting company telling me I'm in violation of their Acceptable Use Policy.

They forwarded me an email from another company complaining about something to do with a "TCP sweep of port 22". They included a snippet from their logs,

20:29:43  <MY_SERVER_IP>  0.0.0.0        [TCP-SWEEP]
(total=325,dp=22,min=212.1.191.0,max=212.1.191.255,Mar21-20:26:34,Mar21-20:26:34)
(USI-amsxaid01)

Now, my server knowledge is limited at best, and I've absolutely no idea what this is or what could be causing it.

Any help would be greatly appreciated!

Thank you

2 Answers 2

8

It sounds like they're saying that your machine is scanning TCP port 22 on other machines. If you didn't configure your server to do this then someone else did. Your machine has probably been compromised and malicious third-party software has been installed.

If that's the case, it's time to level the machine, reload the OS, and restore data from a good backup. You should also do some analysis to determine the root cause of the compromise and prevent it from happening in the future (i.e. immediately after you restore it when another zombie comes along and compromises it again).

As a practical matter, if you don't know how to do these things then you really need to retain the services of someone who does. Getting your server configured with the least amount of software installed, configured in the most secure manner possible (least privilege, no default passwords, unnecessary features / functions disabled, etc), and on a regular security patch installation schedule will do wonders to prevent this kind of thing from happening again.

6
  • You were spot in. Someone got into my box at around midnight GMT and put some software in /var/tmp. All the files belonged to root except for 1 which belonged to an FTP user. I've removed said software and vsftpd and I'll monitor the situation. Cheers for the help. Mar 22, 2010 at 16:45
  • 4
    Be careful. Many hacking toolkits replace critical system utilities and have a means to hide some of the hacked functionality. If you can nuke the server, unless you have a way to verify the integrity of everything on it. Mar 22, 2010 at 16:48
  • 3
    @Stephen Melrose: Duffbeer703 is absolutely right. The only resolution you should be alright is one that insures integrity of the binaries on the machine. If you don't have a way to boot a freestanding OS and verify signatures on all the binaries on the machine you're really better off leveling and reloading it. Mar 22, 2010 at 16:51
  • 1
    The big problem is - you still dont know HOW they got in. This, interesting enough, is a lot more important than cleaning up the server. Because they will be back.
    – TomTom
    Mar 22, 2010 at 18:09
  • 1
    Sounds like the box needs to be pulled out immediately. Restore your backups carefully.
    – MarkR
    Mar 23, 2010 at 16:10
1

Get a professional to review your server. You likely have to reinstall it - because you got a root kit or something. Normally a server does not sweep. I would take everything I trust offand kill the server with a new install image - faster than checking.

Then hire some admin to administrate your server. I am sure your hosting provider has managed hosting ovvers where they handle the administration.

Your statement runs along the line of "The police captured me because I am driving without drivnig licence and basically I have no clue how to drive, what should I do". Running a server on the internet is not exactly trivial and "no idea what this is" is not going to help you here.

You basically are better off with a managed server (if your hosting provider offers that) than one where you can hang yourself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .