0

We have a Linux server at a large hosting provider that has approximately 75 Joomla! websites being hosted on it. We use maldet to scan daily for possible malware on all these sites. In the last week or so, files have been showing up in /tmp

/tmp/20130930-202240-UkpAAEBaJ74AABlPLiMAAAAL-file-cdQfYQ
/tmp/20131001-004117-Ukp8nUBaJ74AAGD@-W0AAAAD-file-P6KfRr
/tmp/20131001-004128-Ukp8qEBaJ74AAGEdQ88AAAAI-file-W65Hp6

They are owned by the user apache runs as, and they contain malicious encoded PHP code. We would like to find out which site, or sites, are being attacked. We need to know where or how these files are being created from. Obviously, just 1 user account controls all those sites, so that makes things difficult to narrow down.

Is there anyway to audit Apache and determine which website these files are being created from?

Thanks, Jay

Improve this question

3 Answers 3

Reset to default
2

You should examine apache2-mod-itk and provide a user by virtualhost. You will find easilly which user have a problem, which virtualhost should be stopped, which file is created, which packet is going through your iptables firewall...

Then it becomes easy in a shared world

Improve this answer
1
  • 1
    That is a good suggestion that I will investigate. In the event that my hosting provider will not allow us to install and use that, they might throw a fit and consider us unsupported, are there any other options?
    – titleistfour
    Oct 3, 2013 at 14:24
0

do you have a list of your joomla-sites telling you, which of it are outdated? there was an ugly flaw recently, allowing for remote code execution

exploit-scanners WILL find your sites, esp. when telling which version they run on, so my guess: every outdated joomla-instance should be investigated.

Improve this answer
1
  • About 2 weeks ago we updated every site to the latest version of Joomla at that time. So, they are probably ok, unless something new was discovered since.
    – titleistfour
    Oct 4, 2013 at 15:44
0

Perhaps correlate the timestamps between the /tmp files and your Apache access logs? Depending on your timestamp resolution and how busy your sites are, you might be able to identify which requests are creating the files.

If you are using ext4, you could turn off atime on ext4 so that file access times mimics file creation times, and use logger to send access logs from apache to rsyslog, and together these measures would give you fairly precise timestamps, not necessarily 100% accurate but quite possibly good enough to track things down.

For adjusting ext4 options, see:

man 8 mount
man 5 fstab

For adjusting Apache logs, see:

http://httpd.apache.org/docs/2.2/logs.html

Something like:

CustomLog "|/usr/bin/logger -p local6.info" vhost_combined

For adjusting syslog settings, see:

man 8 rsyslogd
Improve this answer
1
  • Unfortunately, the box filesystems are all formatted ext3.
    – titleistfour
    Oct 4, 2013 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .