Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running apache on linux server. I have noticed the following processes running which I am not expecting to see, and appear rogue.

Can anyone please advise me what they mean?

Running ps aux | grep apache gave me the following:

root      6196  0.2  0.0  86708  3100 ?        Ss   04:44   0:00 sshd: apache [priv]

sshd      6202  0.0  0.0  61868  1372 ?        S    04:44   0:00 sshd: apache [net]

The server was recently hacked by "c99shell" (http://www.chr00t.com/2009/01/c99shell-security/) script which I tracked down and removed (as far as I know).

Thanks, Mark.

share|improve this question

4 Answers 4

If your server was rooted, you should reinstall the entire server if you want to be sure nothing of the rootkit is left...

In addition, it's possible that you've been rooted again if you didn't fix the security leak that led to you being rooted before.

Also: If you're running a public server on the internet, please get professional help for administrating it. Otherwise your server is a ticking botnet timebomb for everyone else.

share|improve this answer

You have someone logged in via ssh as the user apache. Your system is probably still compromised!

share|improve this answer
    
I have already disabled apache user's ssh access. How can that user still login via ssh? This is what the entry in /etc/passwd looks like: apache:x:48:48:Apache:/var/sites:/sbin/nologin Thanks. –  Mark Blades Oct 23 '09 at 11:44
    
The hacker may have replaced your SSH binaries or configuration with one that ignores what-ever measures yuo have taken to disable the account. Rebuilding the machine is the only way to truly guarantee that there are no other backdoors like this left open for when you close this one. –  David Spillett Oct 23 '09 at 12:58
    
Trust nothing on your machine, change passwords, discard any ssh private keys etc.. –  rkthkr Oct 23 '09 at 13:22

You definitely still have a problem if those SSH processes are not something you can trace to yourself (and logging in as "apache" via ssh would be an unusual thing to do for any legitimate reason).

I would strongly suggest rebuilding the machine. If the server was hacked, especially if the hack gave the attacker root or other privileged access, you don't know what else it might have ferreted away even if the original hack has been cleaned away. If you don't rebuild you will never be sure that everything unwanted is gone.

Backup your data, wipe the machine, and start afresh. Be careful when reinstalling any third-party apps and scripts that you have the latest versions and have them configured securely, and review your own code before you put it back on too to make sure there are no issues there (either a fault that may have let the attacker in in the first place, or a fault added by the attacker once in to make it easier to get back in later).

share|improve this answer
    
+1 a previously hacked machine can no longer be trusted –  3dinfluence Oct 23 '09 at 12:45

You really need to rebuild the machine clean. Once a system is compromised, there is NO guarantee you removed all the back doors, rootkits, and alterations.

None

Breaking into the system is just the first step. After that the cracker could have uploaded anything, including tools to compromise root and from there replace system binaries so that you might have utilities that won't even show the things going on in the background (altered ps, ls, tcpdump, lsof, etc.) and then outside crackers won't be detected unless you're auditing connections from an outside system (and IDS or at the firewall/router).

That's the only way to really deal with a compromise once discovered. There's no such thing as being fully cleaned up without a rebuild. That's why you need good routine backups and intrusion detection tools.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.