Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just like the title asks, what can I do to protect against infection by the Apache Linux/Cdorked.A backdoor?

share|improve this question

to check if you're compromised:

strings /path/to/httpd | egrep open_tty

if grep returns ANY line, you're compromised.

it looks like the mode of breakage is via brute force ssh. So best practices to protect your server is: disable the root account, use sudo, and disables ANY user that has /bin/bash login, AND enforce good passwords or no passwords at all and use ssh keys.

share|improve this answer

As Marcel says good password policy is a must in any case.

ssh keys is a fantastic idea, (and) disabling password login on sshd is also great but often not practical.

see: ssh-copy-id (or you can do it by hand) FWIW I set up different key pairs for almost every account.

Also consider a detection software like rkhunter , chkrootkit or some other tripwire type tools.

Finally run monitoring tools like monit. (many others)

These tools can be configured to checksum most any file and scream on alterations to sizes permissions restarts etc etc.

Some quickly googled refs:

share|improve this answer
Why would you say that disabling password logging with SSH is impractical ? If you know how to do it, it's a 5 minute job. If you don't, it's a (one-time) 30 minutes job, including downloading putty and setting up your private key. I didn't downvote you because your other advises are sane but frankly, I think you should do a reality check on forcing SSH logon with a public key. – Stephane May 1 '13 at 7:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.