1

I feel as if my server (ubuntu 10.4) has been attacked. I'm a bit of a linux noob.

I run a website and a few rows of mysql data have been deleted. This has happened three times now.

  • The auth log is empty prior to 2:00pm ET today. All that shows prior to my logins were a few cronjobs running. The data disappeared between 7pm and 10pm ET.
  • I've never scheduled any cronjobs. There must be automated ones?
  • The mysql error log is wiped clean.
  • I use a password to log in- an obvious mistake I suppose.

Any recommendations? I clean user submitted data for sql injections already. MySQL is not available remotely. I suppose it's time to switch to a key for ssh access.

Improve this question
2
  • what was you password? :) was it a simple one?
    – mykhal
    Oct 25, 2010 at 3:24
  • Simple by today's standards I suppose. Five letters and two numbers, no capitalization or symbols.
    – scrot
    Oct 25, 2010 at 3:26

2 Answers 2

Reset to default
2

Can your data be modified / deleted through your website? If so, can it be modified through a GET request, or only through PUT / POST / DELETE? Is your website linked from anywhere? It is possible that if your website is linked from somewhere and that you have web pages that use operations such as "GET" that are considered to be non-mutating to perform a mutating operation, it is possible that a web crawler may have accidentally stumbled upon a delete link every so often. One way to fix this is to use only PUT / POST / DELETE for mutating operations, or to guard those links with a "robots.txt" file. Regardless of the cause, if your password is fairly weak, using a better password is a fairly obvious thing to do. Certainly you are no worse off for choosing a strong, secure password for your server and site.

Improve this answer
4
  • Certain data can be modified and created, but not deleted on the site. The data that was deleted cannot be modified, created, or deleted outside of MySQL's command line itself, which obviously makes me think someone has gained access to the server.
    – scrot
    Oct 25, 2010 at 3:34
  • Err, forgot to mention that the last time this happened, I assumed it was a crawler, and I closed the only link leading straight to a query, and added required authentication, a no brainer. The site already uses POST exclusively and all data is scanned for injections. I do get a fair amount of traffic on the site.
    – scrot
    Oct 25, 2010 at 3:36
  • Ok, then it's certainly possible. Definitely would advise changing passwords, since that is a no-brainer thing to do.
    – Michael Aaron Safyan
    Oct 25, 2010 at 3:37
  • Okay, it was google. It turns out I re-enabled an unprotected database page without realizing it today. Absolutely bonehead of me.
    – scrot
    Oct 25, 2010 at 4:39
1

Yes, there are going to be standard cronjobs running...one of which rotates your log files. Have you looked for an error.log.1 or access.log.1?

Improve this answer
2
  • Yep, I see that now. Appears I've gotten numerous attacks over the last few days from about 5 different IP addresses.
    – scrot
    Oct 25, 2010 at 3:39
  • @scrot: that's pretty typical, having people hit an open port 80 with misc attacks that work on various installed software that may be missing security patches.
    – ysth
    Oct 25, 2010 at 4:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .