Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I feel as if my server (ubuntu 10.4) has been attacked. I'm a bit of a linux noob.

I run a website and a few rows of mysql data have been deleted. This has happened three times now.

  • The auth log is empty prior to 2:00pm ET today. All that shows prior to my logins were a few cronjobs running. The data disappeared between 7pm and 10pm ET.
  • I've never scheduled any cronjobs. There must be automated ones?
  • The mysql error log is wiped clean.
  • I use a password to log in- an obvious mistake I suppose.

Any recommendations? I clean user submitted data for sql injections already. MySQL is not available remotely. I suppose it's time to switch to a key for ssh access.

share|improve this question

migrated from stackoverflow.com Oct 25 '10 at 3:27

This question came from our site for professional and enthusiast programmers.

    
what was you password? :) was it a simple one? –  mykhal Oct 25 '10 at 3:24
    
Simple by today's standards I suppose. Five letters and two numbers, no capitalization or symbols. –  scrot Oct 25 '10 at 3:26

2 Answers 2

up vote 2 down vote accepted

Can your data be modified / deleted through your website? If so, can it be modified through a GET request, or only through PUT / POST / DELETE? Is your website linked from anywhere? It is possible that if your website is linked from somewhere and that you have web pages that use operations such as "GET" that are considered to be non-mutating to perform a mutating operation, it is possible that a web crawler may have accidentally stumbled upon a delete link every so often. One way to fix this is to use only PUT / POST / DELETE for mutating operations, or to guard those links with a "robots.txt" file. Regardless of the cause, if your password is fairly weak, using a better password is a fairly obvious thing to do. Certainly you are no worse off for choosing a strong, secure password for your server and site.

share|improve this answer
    
Certain data can be modified and created, but not deleted on the site. The data that was deleted cannot be modified, created, or deleted outside of MySQL's command line itself, which obviously makes me think someone has gained access to the server. –  scrot Oct 25 '10 at 3:34
    
Err, forgot to mention that the last time this happened, I assumed it was a crawler, and I closed the only link leading straight to a query, and added required authentication, a no brainer. The site already uses POST exclusively and all data is scanned for injections. I do get a fair amount of traffic on the site. –  scrot Oct 25 '10 at 3:36
    
Ok, then it's certainly possible. Definitely would advise changing passwords, since that is a no-brainer thing to do. –  Michael Aaron Safyan Oct 25 '10 at 3:37
    
Okay, it was google. It turns out I re-enabled an unprotected database page without realizing it today. Absolutely bonehead of me. –  scrot Oct 25 '10 at 4:39

Yes, there are going to be standard cronjobs running...one of which rotates your log files. Have you looked for an error.log.1 or access.log.1?

share|improve this answer
    
Yep, I see that now. Appears I've gotten numerous attacks over the last few days from about 5 different IP addresses. –  scrot Oct 25 '10 at 3:39
    
@scrot: that's pretty typical, having people hit an open port 80 with misc attacks that work on various installed software that may be missing security patches. –  ysth Oct 25 '10 at 4:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.