Tagged Questions
0
votes
1answer
66 views
How to lockdown a Ubuntu 12.04 web server [duplicate]
All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with
nginx 1.27
php5-fpm
php 5.4.14
mysql 5.5
postgresql 9.1
...
0
votes
0answers
45 views
"Success resolving X in X after reducing the advertised. Possible hack?
In my sys log I sometimes see this message:
success resolving 'ns.macomnet.ru/AAAA' (in 'macomnet.ru'?) after reducing the advertised EDNS UDP packet size to 512 octets
I am not using those name ...
1
vote
1answer
268 views
Server Hacked + Huge Bandwidth Usage Spike [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
1answer
366 views
Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked
One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw
The ...
11
votes
1answer
1k views
ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?
My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork:
ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
-1
votes
1answer
70 views
Old ubuntu password
I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
0
votes
2answers
283 views
Possible hack attack in Ubuntu Server?
I am having a Ubuntu 10.04 Server with Shorewall 4.4.6.
For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log.
It occupied all ...
2
votes
2answers
1k views
Ubuntu Server hack
I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access.
I found this in an ftp user .bash_history ...
9
votes
2answers
4k views
My linux server was hacked. How do I find out how and when it was done?
I have a home server running a desktop ubuntu distribution. I found this in my crontab
* * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1
and when looking in that directory ...
0
votes
6answers
115 views
Which are services or programs do I need to watch from linux security point of view
I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password.
i just saw ...
0
votes
6answers
1k views
how to check for sniffers in Ubuntu?
Somebody is accusing me that my linux ubuntu machine could be the source for a server attack.
Their technique was replacing the
original ssh by this patched ssh and,
as such eliminated all ...
0
votes
4answers
476 views
Ubuntu Web server compromised; find out what is spawning processes
The Ubuntu Web server that I just inherited has been compromised. I'm a Windows admin and not all too familiar with Linux.
How would I go about finding out what keeps spawning perl processes? I ...
1
vote
3answers
2k views
Ubuntu Server attack? how to solve?
Something (Someone) is sending out UDP packets sent from our whole ip range. This seems to be multicast DNS.
Our server host provided this (Our IP Address is masked with XX):
Jun 3 11:02:13 ...
1
vote
3answers
1k views
sudo without password?
Some strange things are happening with my Ubuntu box today as a regular (non-root user):
As soon as I log in, I can sudo without typing my password (normally, I believe I always have to type my ...
