0
votes
3answers
671 views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
1
vote
3answers
291 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
0answers
18 views

My server was used in a regBot attack [duplicate]

I have a Ubuntu 12.04 x64 web server that I only use to host downloads from my website. My website is on another server. I am the only person with access to the server. Today it was blocked by ...
0
votes
1answer
331 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
0
votes
1answer
176 views

How to lockdown a Ubuntu 12.04 web server [duplicate]

All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with nginx 1.27 php5-fpm php 5.4.14 mysql 5.5 postgresql 9.1 ...
0
votes
0answers
144 views

"Success resolving X in X after reducing the advertised. Possible hack?

In my sys log I sometimes see this message: success resolving 'ns.macomnet.ru/AAAA' (in 'macomnet.ru'?) after reducing the advertised EDNS UDP packet size to 512 octets I am not using those name ...
1
vote
1answer
375 views

Server Hacked + Huge Bandwidth Usage Spike [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
1answer
535 views

Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked

One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw The ...
11
votes
1answer
1k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
-1
votes
1answer
71 views

Old ubuntu password

I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
0
votes
2answers
342 views

Possible hack attack in Ubuntu Server?

I am having a Ubuntu 10.04 Server with Shorewall 4.4.6. For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log. It occupied all ...
2
votes
2answers
1k views

Ubuntu Server hack

I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access. I found this in an ftp user .bash_history ...
9
votes
2answers
4k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
6answers
117 views

Which are services or programs do I need to watch from linux security point of view

I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password. i just saw ...
0
votes
6answers
2k views

how to check for sniffers in Ubuntu?

Somebody is accusing me that my linux ubuntu machine could be the source for a server attack. Their technique was replacing the original ssh by this patched ssh and, as such eliminated all ...
0
votes
4answers
667 views

Ubuntu Web server compromised; find out what is spawning processes

The Ubuntu Web server that I just inherited has been compromised. I'm a Windows admin and not all too familiar with Linux. How would I go about finding out what keeps spawning perl processes? I ...
1
vote
3answers
2k views

Ubuntu Server attack? how to solve?

Something (Someone) is sending out UDP packets sent from our whole ip range. This seems to be multicast DNS. Our server host provided this (Our IP Address is masked with XX): Jun 3 11:02:13 ...
1
vote
3answers
2k views

sudo without password?

Some strange things are happening with my Ubuntu box today as a regular (non-root user): As soon as I log in, I can sudo without typing my password (normally, I believe I always have to type my ...