Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Tips for Securing a LAMP Server.

First of all sorry for my stupidness.

I run a server, but everytime (once a week) it get 'hacked' by some things. The index is changing to "Hacked By XXXX". I could grep an ps aux | grep php and found a line like this:

  • apache 43434 xxx php iphone.jpg -

Normally it isn't possible to execute an jpg is it? I though i had fix it. But is there an solution for it? It had chmod 777 I believe.

Are there some other must-read articles about security?

share|improve this question

marked as duplicate by Iain, Doug Luxem, Ben Pilbrow, sysadmin1138 Apr 4 '11 at 21:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Start with the answers to this question serverfault.com/questions/212269/… –  Iain Apr 4 '11 at 21:09
3  
No need to post a greeting or sign your posts. Just post the question itself. We all know who you are, and your acceptance of our answers is thanks enough. –  EEAA Apr 4 '11 at 21:09

1 Answer 1

If these hacks are repeating, maybe you've not corrected the exploited vulnerability.

If you're using CMS, update them with the latest version. If you're running your own code, analyse it, get some help to debug it and find the hole.

For now your hacks were quite limited. An index change is not a big deal. But maybe once a hacker will be able to exploit the vulnerability deeper, like creating a user account, maybe gaining root privileges and start doing nasty stuff you don't want to happen...

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.