Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just like the title asks, what can I do to protect against infection by the Apache Linux/Cdorked.A backdoor?

share|improve this question
add comment

2 Answers

to check if you're compromised:

strings /path/to/httpd | egrep open_tty

if grep returns ANY line, you're compromised.

it looks like the mode of breakage is via brute force ssh. So best practices to protect your server is: disable the root account, use sudo, and disables ANY user that has /bin/bash login, AND enforce good passwords or no passwords at all and use ssh keys.

share|improve this answer
add comment

As Marcel says good password policy is a must in any case.

ssh keys is a fantastic idea, (and) disabling password login on sshd is also great but often not practical.

see: ssh-copy-id (or you can do it by hand) FWIW I set up different key pairs for almost every account.

Also consider a detection software like rkhunter , chkrootkit or some other tripwire type tools.

Finally run monitoring tools like monit. (many others)

These tools can be configured to checksum most any file and scream on alterations to sizes permissions restarts etc etc.

Some quickly googled refs:

http://www.debian.org/devel/passwordlessssh

http://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/

share|improve this answer
1  
Why would you say that disabling password logging with SSH is impractical ? If you know how to do it, it's a 5 minute job. If you don't, it's a (one-time) 30 minutes job, including downloading putty and setting up your private key. I didn't downvote you because your other advises are sane but frankly, I think you should do a reality check on forcing SSH logon with a public key. –  Stephane May 1 '13 at 7:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.