Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked.

But I have no clue to what I should do :-/

I was alerted when all my wesites on my server started to go very slow, and some did not even load.

Server type: VPS
OS: Linux 2.6.18
Server: Centos 5
Admin interface: Parallels Plesk 9

Current mem usage: 200 of 1024.

Error log file 10th July

[Sat Jul 09 15:37:38 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/web
[Sat Jul 09 15:37:39 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/php-my-admin
[Sat Jul 09 15:37:39 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/websql
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpmyadmin
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/php-my-admin
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.2.3
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.2.6
[Sat Jul 09 15:37:42 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.1
[Sat Jul 09 15:37:42 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.4
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5-rc1
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5-rc2
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5
[Sat Jul 09 19:15:14 2011] [notice] mod_fcgid: process /var/www/vhosts/mysite.no/httpdocs/index.php(9512) exit(server exited), terminated by calling exit(), return code: 0
[Sat Jul 09 20:01:34 2011] [error] [client 93.158.147.8] File does not exist: /var/www/vhosts/default/htdocs/robots.txt
[Sat Jul 09 21:09:18 2011] [notice] mod_fcgid: process /var/www/vhosts/mysite.no/httpdocs/index.php(18166) exit(normal exit), terminated by calling exit(), return code: 0
[Sat Jul 09 21:09:18 2011] [warn] mod_fcgid: cleanup zombie process 18166

Error log file tth August

[Sun Jul 31 03:34:54 2011] [warn] Init: SSL server IP/port conflict: default-217-170-195-78:443 (/etc/httpd/conf.d/zz010_psa_httpd.conf:78) vs. horde.webmail:443 (/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Sun Jul 31 03:34:54 2011] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sun Jul 31 03:34:54 2011] [warn] WARNING: Attempt to change ServerLimit ignored during restart
[Wed Aug 03 18:54:45 2011] [notice] mod_fcgid: server /var/www/vhosts/mysite.no/httpdocs/index.php(10098) started
[Wed Aug 03 18:54:46 2011] [notice] mod_fcgid: too much /var/www/vhosts/mysite.no/httpdocs/index.php process(current:8, max:8), skip the spawn request
[Sun Jul 31 12:20:29 2011] [warn] mod_fcgid: cleanup zombie process 17543
[Thu Aug 04 07:38:57 2011] [error] [client 188.138.88.210] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

I've googled a bit to see if tehre are any "guides" to what I should do. But I've just found lot of forums with ppl in the same situations as my self, and no clear answer.

There probably is no clear answer, but I'm pretty sure there are a few steps that everyone should know about.

What steps should I do now to stop getting hacked?

The post My server's been hacked EMERGENCY is very good post, with a lot of info. But right now, it's not helping me to stop whatever is attacking me. I need to figure out whot to stop this so I can start taking backups and re-install the server.

share|improve this question

marked as duplicate by EEAA, Tom O'Connor, voretaq7, Zoredache, mrdenny Aug 4 '11 at 19:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
@ErikA: not that one - but one of the automated scanning questions which elude me atm would be better. –  Iain Aug 4 '11 at 19:24
    
@Iain - yep, you're absolutely right. Bad vote on my part. –  EEAA Aug 4 '11 at 19:27
    
1  
@sysadmin1138: or this one ? serverfault.com/questions/108578/… –  Iain Aug 4 '11 at 19:41
    
@sysadmin1138 Yes, its an auto scan, therefore a dupe of your Link –  Jacob Aug 4 '11 at 19:42

6 Answers 6

What makes you think that you are hacked? The logs show no indication to that.

They just show that someone tried to access some files that don't exist on your server.

And they show that you have a misconfigured webserver with a cgi module causing zombie processes and dying processes.

share|improve this answer
    
Yeah, this isn't a hack at all. –  ceejayoz Aug 4 '11 at 19:38
    
I've not edited any files / config / data on my server for the last two months. It was running fine last week, but a few days ago it got very slow and some times it's not laoding. I reset Apache last night, but today it's thesame. It's also requestion a lot of admin pages. So I'm guessingthere is a bad bot doing something nasty. –  Steven Aug 4 '11 at 19:40
    
If you are in doubt then follow the other answers. If you want an estimate from the logs, then there is no "hacking". When you have other information, then provide them. –  mailq Aug 4 '11 at 19:45

@Iain has commented that this was an automated scan, and I'm not sure off the top of my head if he's right or wrong, but I do think that it's worth being careful since nuking the site and rebuilding it is a tad bit laborious if this is just a scan.

First, do you have backups? If so you can try comparing your backup's /sbin and /bin and other directory's contents with your production environment to find changes.

Do you have file integrity checkers installed? It's useless after the fact if you've been hacked but if you haven't, consider installing a system like tripwire or samhain. Properly configured, they can email you alerts when files are altered or there's suspicious activity. (NOTE-this takes maintenance. When you do updates to the system, update their databases accordingly)

Check the system with chkrootkit and rkhunter.

Monitor your system for unusual network activity. Use programs like ntop; get statistics on your system's "normal" behavior so you know when something isn't right or should be looked into. Check for unusual open ports.

Scan your system with clamscan to see if that trips any ususual malware signs.

And if you don't have backups...start making them!

For the time being I'd google for similar behavior you see in the logs and see if others have posted about it and found it to be just a scan. If your system isn't acting funny and the malware scanning tools aren't finding anything you probably don't have to worry (although if it has been hacked, the paranoid response is to not trust your binaries...). If you installed through a distro that uses a packager, it may be possible to check your binaries against the packager to make sure everything matches...if the checksums match, you should be good.

share|improve this answer

I don't think you're being hacked, someone is just testing the locks.
I would block 72.46.146.130 at your firewall (or via a local firewall), and then go about checking your locks yourself (look around here and over on Security.SE for advice).

You can lift the firewall rule later at your leisure - You may also want to contact the abuse folks at VersaWeb (Contact info in the Whois for the IP) and report the incident if you're feeling particularly helpful/pedantic.

share|improve this answer

This is just a bot looking for installations of phpMyAdmin - there are bugs in older versions that can be exploited. We see similar patterns on our servers all the time. You haven't been hacked, but you should be careful to keep any phpMyAdmin installs you may have up-to-date.

share|improve this answer

EDIT: As others have noted, the logs indicate it's just a scan. I'll leave this here as a quickie guide for hack recovery though.

  1. Backup all logs that you have for the server in it's hacked state.
  2. (Maybe even dd the server for testing in a controlled environment)
  3. Nuke it from orbit.
  4. Examine your post-hack logs to determine how you got hacked. Remove the code that caused the infiltration.
  5. Rebuild from backups that you took pre-hack (can you trust them? I mean, really?) or rebuild from the ground-up.
  6. Harden your server using the information you gleaned from the logs post-hack.

You must figure out how this happened. Likely it was some piece of insecure code. Get someone to help you out if you need to, but just rebuilding is going to ensure that this happens again.

share|improve this answer
1  
It's just an automated scan. –  Iain Aug 4 '11 at 19:30

EDIT: As others have noted, the logs indicate it's just a scan. I'll leave this here as a quickie guide for hack recovery though.

My hacking-disaster-plan:

  1. Shut down server
  2. Make a dd-copy of the server's HDD
  3. Rebuild the whole thing
  4. Use the HDD to recover log files if you do not have a backup and analyze your weak points

Turning the server off might be difficult for you (VPS) so get a quick backup and kill it with fire.

share|improve this answer
2  
It may be counter productive to get a backup post-hack, unless you mean to use it for analysis. For data recovery, not so much... –  Bart Silverstrim Aug 4 '11 at 19:28
    
@Bart Silverstrim: True, edited for clarity. –  Bart De Vos Aug 4 '11 at 19:31
    
If you absolutely must recover files from an image of a hacked server you need to examine them with a microscope. –  voretaq7 Aug 4 '11 at 19:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.