Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Linux server at a large hosting provider that has approximately 75 Joomla! websites being hosted on it. We use maldet to scan daily for possible malware on all these sites. In the last week or so, files have been showing up in /tmp

/tmp/20130930-202240-UkpAAEBaJ74AABlPLiMAAAAL-file-cdQfYQ
/tmp/20131001-004117-Ukp8nUBaJ74AAGD@-W0AAAAD-file-P6KfRr
/tmp/20131001-004128-Ukp8qEBaJ74AAGEdQ88AAAAI-file-W65Hp6

They are owned by the user apache runs as, and they contain malicious encoded PHP code. We would like to find out which site, or sites, are being attacked. We need to know where or how these files are being created from. Obviously, just 1 user account controls all those sites, so that makes things difficult to narrow down.

Is there anyway to audit Apache and determine which website these files are being created from?

Thanks, Jay

share|improve this question
add comment

3 Answers 3

You should examine apache2-mod-itk and provide a user by virtualhost. You will find easilly which user have a problem, which virtualhost should be stopped, which file is created, which packet is going through your iptables firewall...

Then it becomes easy in a shared world

share|improve this answer
1  
That is a good suggestion that I will investigate. In the event that my hosting provider will not allow us to install and use that, they might throw a fit and consider us unsupported, are there any other options? –  titleistfour Oct 3 '13 at 14:24
add comment

do you have a list of your joomla-sites telling you, which of it are outdated? there was an ugly flaw recently, allowing for remote code execution

exploit-scanners WILL find your sites, esp. when telling which version they run on, so my guess: every outdated joomla-instance should be investigated.

share|improve this answer
    
About 2 weeks ago we updated every site to the latest version of Joomla at that time. So, they are probably ok, unless something new was discovered since. –  titleistfour Oct 4 '13 at 15:44
add comment

Perhaps correlate the timestamps between the /tmp files and your Apache access logs? Depending on your timestamp resolution and how busy your sites are, you might be able to identify which requests are creating the files.

If you are using ext4, you could turn off atime on ext4 so that file access times mimics file creation times, and use logger to send access logs from apache to rsyslog, and together these measures would give you fairly precise timestamps, not necessarily 100% accurate but quite possibly good enough to track things down.

For adjusting ext4 options, see:

man 8 mount
man 5 fstab

For adjusting Apache logs, see:

http://httpd.apache.org/docs/2.2/logs.html

Something like:

CustomLog "|/usr/bin/logger -p local6.info" vhost_combined

For adjusting syslog settings, see:

man 8 rsyslogd
share|improve this answer
    
Unfortunately, the box filesystems are all formatted ext3. –  titleistfour Oct 4 '13 at 15:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.