3

I'm running Apache on Linux server. I have noticed the following processes running which I am not expecting to see, and appear rogue.

Can anyone please advise me what they mean?

Running ps aux | grep apache gave me the following:

root      6196  0.2  0.0  86708  3100 ?        Ss   04:44   0:00 sshd: apache [priv]
sshd      6202  0.0  0.0  61868  1372 ?        S    04:44   0:00 sshd: apache [net]

The server was recently hacked by c99shell (http://www.chr00t.com/2009/01/c99shell-security/) script which I tracked down and removed (as far as I know).

0

4 Answers 4

7

If your server was rooted, you should reinstall the entire server if you want to be sure nothing of the rootkit is left...

In addition, it's possible that you've been rooted again if you didn't fix the security leak that led to you being rooted before.

Also: If you're running a public server on the internet, please get professional help for administrating it. Otherwise your server is a ticking botnet timebomb for everyone else.

5

You have someone logged in via ssh as the user apache. Your system is probably still compromised!

4
  • I have already disabled apache user's ssh access. How can that user still login via ssh? This is what the entry in /etc/passwd looks like: apache:x:48:48:Apache:/var/sites:/sbin/nologin Thanks.
    – Mark Blades
    Oct 23, 2009 at 11:44
  • The hacker may have replaced your SSH binaries or configuration with one that ignores what-ever measures yuo have taken to disable the account. Rebuilding the machine is the only way to truly guarantee that there are no other backdoors like this left open for when you close this one. Oct 23, 2009 at 12:58
  • 1
    Trust nothing on your machine, change passwords, discard any ssh private keys etc..
    – rkthkr
    Oct 23, 2009 at 13:22
  • This means someone might be trying to log in as user apache on ssh. Disable passwords and use key based auth. But, if you have been definitely been compromised, do rebuild the server. Oct 23, 2019 at 20:27
3

You definitely still have a problem if those SSH processes are not something you can trace to yourself (and logging in as "apache" via ssh would be an unusual thing to do for any legitimate reason).

I would strongly suggest rebuilding the machine. If the server was hacked, especially if the hack gave the attacker root or other privileged access, you don't know what else it might have ferreted away even if the original hack has been cleaned away. If you don't rebuild you will never be sure that everything unwanted is gone.

Backup your data, wipe the machine, and start afresh. Be careful when reinstalling any third-party apps and scripts that you have the latest versions and have them configured securely, and review your own code before you put it back on too to make sure there are no issues there (either a fault that may have let the attacker in in the first place, or a fault added by the attacker once in to make it easier to get back in later).

1
  • +1 a previously hacked machine can no longer be trusted Oct 23, 2009 at 12:45
3

You really need to rebuild the machine clean. Once a system is compromised, there is NO guarantee you removed all the back doors, rootkits, and alterations.

None

Breaking into the system is just the first step. After that the cracker could have uploaded anything, including tools to compromise root and from there replace system binaries so that you might have utilities that won't even show the things going on in the background (altered ps, ls, tcpdump, lsof, etc.) and then outside crackers won't be detected unless you're auditing connections from an outside system (and IDS or at the firewall/router).

That's the only way to really deal with a compromise once discovered. There's no such thing as being fully cleaned up without a rebuild. That's why you need good routine backups and intrusion detection tools.

You must log in to answer this question.