0

Since setting up my dedicated server I have been hit with many viruses. 1 would eat up my bandwidth and another is currently sending out trojans to any outgoing mail from my mail server.

Is there a way to set up a server to prevent this from happening? I have ClamAV installed, I have IP addresses blocked on my iptables. But that doesn't seem to be enough.

I'm just wondering what other people do when they set up a dedicated server.

Thanks!

Improve this question
1
  • When you set it up, did you know what you were doing? Do you keep packages up to date? What OS are you running? What IP addresses are "blocked on your iptables" and how did you pick them?
    – ceejayoz
    Jun 7, 2011 at 16:23

3 Answers 3

Reset to default
1

Sounds like you're talking about rootkits, trojans and worms - not viruses (since this appears to be a Linux server not a MSWindows box).

ClamAV is an anti-virus tool while it does go some way to detecting other types of malware it's abilities are very limited. Indeed, unless your are running samba on the server (which would be a really dumb thing to do) or are allowing anyone to upload files (again, dumb) there's no point in using ClamAV.

The first thing to do is to get the server wiped clean and reinstalled from source media. Then follow the usual steps in re-instating the services (i.e. make sure you're not installing the same backdoors from your backups).

I'd recommend getting some competent help to harden the server - it shouldn't take more than about a day to get the system relatively secure (assuming you've already ensured that anything you've restored from backup is safe). Part of this will include locking down any remote admin access, particularly via ssh.

You should also instigate regular backups and runs of rkhunter / chkrootkit.

Improve this answer
3
  • I've run rkhunter just now and it says SSH access as root is enabled. That's probably the main problem right there?
    – Jason
    Jun 7, 2011 at 16:45
  • 2
    does the root user have a really strong password? See this thread for ways to protect ssh access: serverfault.com/questions/276934/…
    – uSlackr
    Jun 7, 2011 at 16:48
  • Strong passwords are no substitute for disabling root ssh access.
    – symcbean
    Jun 10, 2011 at 12:28
0

Investigate how you got the viruses in first place, Unaware users? Applications? Mail? Network drive?

  • Set users, passwords and permissions. Theres a lot of strategies for securing your system but keep simple and just close everything until someone needs it.
  • Keep logs of applications and what your users are doing.
  • Have a portafolio of applications and users
  • Dont use the server for checking mail, chatting or playing. Dont allow anyone to use it, only its services.

Keep it simple and clean.

Rigth now i would recommend you to format and get the server from zero again. In my expirience i have not found the need for antivirus on mi windows boxes, just keep control of your server.

What OS are you using?

Improve this answer
2
  • CentOS Linux 5.6
    – Jason
    Jun 7, 2011 at 16:28
  • "Keep logs of applications and what your users are doing" - Why???? Unless you really know what you're doing, this is a waste of time.
    – symcbean
    Jun 7, 2011 at 16:39
0

The bad news:

  • To run a public server you need to know what you're doing, to learn that you need to run a public server (yes you can learn about what is needed, but you won't have the same experience just the theoretical background -- which you need anyway -- NOTE: I'm not saying you should just run a public server without prior theoretical knowledge)
  • To reliably clean a compromised server the only way to be sure is a complete installation from scratch

Basic things to secure a server:

  • do not allow remote logins over unencrypted channels (telnet)
  • do not allow remote root login (never!)
  • do not allow password based logins
    • if you can't go without password based logins be sure to use a strong password
  • by default your firewall should block all incoming and outgoing connections
  • grant access based on real requirements (do you really want to allow all outgoing connections, or rather just the connections that are already associated with something that came in thru a port that is allowed)
  • don't do badness enumeration (don't send the lines of a logfile that look suspicious, rather send the lines of logfiles that don't match a "known good" pattern -- there is a tool that can do this for you: logcheck)
  • subscribe to the security list of the packages/distro you use and install updates as soon as they are available
    • at least regularly install security updates -- weekly (at least monthly)! Installing every 3 months or every year is not enough (the argument that it might cause downtime and that is too expensive doesn't count. If your service is that valuable you have to have redundancy and test environments anyway so that you can always shut one host down at a time)

Sounds like a lot but all of that is actually very nice to script (assuming Debian/Linux). I'm pretty sure it can also be easily done on other OS but my main env is Debian so that is where I'd know how to do it with the tools that are provided by the distro itself

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .