Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The first symptom was that I couldn't connect on port 6667, thus falling of irc-servers (and was unable to connect to them again). After some tcpdumping etc. I couldn't figure out what caused this, and upgraded my system then rebooted. After the server came up again, I managed to reconnect to irc-server, but when accessing the my web files, the browser displayed a "split header received"-message. On a hunch I connected to port 443 on my web server (through the browser) which displayed page with heading: "Remote Access Controller", which seem to be a Dell tool. The funny thing is that I have no notion of installing/having such a tool. The only similar tool I got is an IPMI-interface (this is a Supermicro server). After a few minutes this response went away, and the website got displayed as usual.

So, have I been rooted, and the attacker installed a Dell tool? The various logs didn't show anything suspect (afaik), so please help me how to further investigate this issue =)

Update:

Stuff I have done to detect malicious behaviour:

  • chkrootkit
  • debsums
  • unhide (for checking processes)
  • Have searched / for weird directories

None of these approaches have revealed anything suspicious. Of course, the tracks of an eventual rootkit could be hidden.

share|improve this question
    
To clarify, is this a home system, or a server you manage/maintain professionally? Also this sounds more like a network problem to me, though it could be the side-effects of a compromise: review the various questions on here about what to do if you think your server has been hacked. –  voretaq7 Apr 16 '12 at 18:51
1  
DRAC (Dell Remote Access Controller) is a expansion card for Dell servers that presents a web interface and not a software module so it is probably not installed on your SuperMicro :D. As above that part of your question sounds like a network problem (arp or DNS cache?). Without a little more information about your system it maybe hard to suggest how you should proceed, but you can certainly run a rootkit detection program such as in serverfault.com/questions/124151/… –  adric Apr 16 '12 at 19:30
    
@voretaq7 I have now updated the post. This is a server I manage, running services like apache, filehosting etc. It's not in a "professional" manner though. –  debianuser Apr 17 '12 at 12:22
    
@adric Yeah, I have ran several of them, not revealing anything specific. Is there no way to make a server respond on port 443 with some DRAC-software? This whole thing seems pretty odd to me. The weird thing is that the server tried to reply with two different headers (namely the web-server and the DRAC-header (which also ran on port 80, with a redirect to 443)). –  debianuser Apr 17 '12 at 12:26
    
@debianuser That really sounds like an IP conflict or some other network malfeasance. I'm not aware of any DRAC software, just the firmware for the cards. Agree on odd :) –  adric May 4 '12 at 13:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.