3

Possible Duplicate:
My server's been hacked EMERGENCY

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked.

But I have no clue to what I should do :-/

Server type: VPS
OS: Linux 2.6.18
Server: Centos 5
Admin interface: Parallels Plesk 9

Current mem usage: 200 of 1024.

Error log file 10th July

[Sat Jul 09 15:37:38 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/web
[Sat Jul 09 15:37:39 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/php-my-admin
[Sat Jul 09 15:37:39 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/websql
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpmyadmin
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin
[Sat Jul 09 15:37:40 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/php-my-admin
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.2.3
[Sat Jul 09 15:37:41 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.2.6
[Sat Jul 09 15:37:42 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.1
[Sat Jul 09 15:37:42 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.4
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5-rc1
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5-rc2
[Sat Jul 09 15:37:43 2011] [error] [client 72.46.146.130] File does not exist: /var/www/vhosts/default/htdocs/phpMyAdmin-2.5.5
[Sat Jul 09 19:15:14 2011] [notice] mod_fcgid: process /var/www/vhosts/mysite.no/httpdocs/index.php(9512) exit(server exited), terminated by calling exit(), return code: 0
[Sat Jul 09 20:01:34 2011] [error] [client 93.158.147.8] File does not exist: /var/www/vhosts/default/htdocs/robots.txt
[Sat Jul 09 21:09:18 2011] [notice] mod_fcgid: process /var/www/vhosts/mysite.no/httpdocs/index.php(18166) exit(normal exit), terminated by calling exit(), return code: 0
[Sat Jul 09 21:09:18 2011] [warn] mod_fcgid: cleanup zombie process 18166

Error log file tth August

[Sun Jul 31 03:34:54 2011] [warn] Init: SSL server IP/port conflict: default-217-170-195-78:443 (/etc/httpd/conf.d/zz010_psa_httpd.conf:78) vs. horde.webmail:443 (/etc/httpd/conf.d/zzz_horde_vhost.conf:41)
[Sun Jul 31 03:34:54 2011] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sun Jul 31 03:34:54 2011] [warn] WARNING: Attempt to change ServerLimit ignored during restart
[Wed Aug 03 18:54:45 2011] [notice] mod_fcgid: server /var/www/vhosts/mysite.no/httpdocs/index.php(10098) started
[Wed Aug 03 18:54:46 2011] [notice] mod_fcgid: too much /var/www/vhosts/mysite.no/httpdocs/index.php process(current:8, max:8), skip the spawn request
[Sun Jul 31 12:20:29 2011] [warn] mod_fcgid: cleanup zombie process 17543
[Thu Aug 04 07:38:57 2011] [error] [client 188.138.88.210] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

I've googled a bit to see if tehre are any "guides" to what I should do. But I've just found lot of forums with ppl in the same situations as my self, and no clear answer.

There probably is no clear answer, but I'm pretty sure there are a few steps that everyone should know about.

What steps should I do now to stop getting hacked?

5
3

What makes you think that you are hacked? The logs show no indication to that.

They just show that someone tried to access some files that don't exist on your server.

And they show that you have a misconfigured webserver with a cgi module causing zombie processes and dying processes.

3
  • Yeah, this isn't a hack at all.
    – ceejayoz
    Aug 4 '11 at 19:38
  • I've not edited any files / config / data on my server for the last two months. It was running fine last week, but a few days ago it got very slow and some times it's not laoding. I reset Apache last night, but today it's thesame. It's also requestion a lot of admin pages. So I'm guessingthere is a bad bot doing something nasty.
    – Steven
    Aug 4 '11 at 19:40
  • If you are in doubt then follow the other answers. If you want an estimate from the logs, then there is no "hacking". When you have other information, then provide them.
    – mailq
    Aug 4 '11 at 19:45
3

@Iain has commented that this was an automated scan, and I'm not sure off the top of my head if he's right or wrong, but I do think that it's worth being careful since nuking the site and rebuilding it is a tad bit laborious if this is just a scan.

First, do you have backups? If so you can try comparing your backup's /sbin and /bin and other directory's contents with your production environment to find changes.

Do you have file integrity checkers installed? It's useless after the fact if you've been hacked but if you haven't, consider installing a system like tripwire or samhain. Properly configured, they can email you alerts when files are altered or there's suspicious activity. (NOTE-this takes maintenance. When you do updates to the system, update their databases accordingly)

Check the system with chkrootkit and rkhunter.

Monitor your system for unusual network activity. Use programs like ntop; get statistics on your system's "normal" behavior so you know when something isn't right or should be looked into. Check for unusual open ports.

Scan your system with clamscan to see if that trips any ususual malware signs.

And if you don't have backups...start making them!

For the time being I'd google for similar behavior you see in the logs and see if others have posted about it and found it to be just a scan. If your system isn't acting funny and the malware scanning tools aren't finding anything you probably don't have to worry (although if it has been hacked, the paranoid response is to not trust your binaries...). If you installed through a distro that uses a packager, it may be possible to check your binaries against the packager to make sure everything matches...if the checksums match, you should be good.

3

I don't think you're being hacked, someone is just testing the locks.
I would block 72.46.146.130 at your firewall (or via a local firewall), and then go about checking your locks yourself (look around here and over on Security.SE for advice).

You can lift the firewall rule later at your leisure - You may also want to contact the abuse folks at VersaWeb (Contact info in the Whois for the IP) and report the incident if you're feeling particularly helpful/pedantic.

2

This is just a bot looking for installations of phpMyAdmin - there are bugs in older versions that can be exploited. We see similar patterns on our servers all the time. You haven't been hacked, but you should be careful to keep any phpMyAdmin installs you may have up-to-date.

2

EDIT: As others have noted, the logs indicate it's just a scan. I'll leave this here as a quickie guide for hack recovery though.

  1. Backup all logs that you have for the server in it's hacked state.
  2. (Maybe even dd the server for testing in a controlled environment)
  3. Nuke it from orbit.
  4. Examine your post-hack logs to determine how you got hacked. Remove the code that caused the infiltration.
  5. Rebuild from backups that you took pre-hack (can you trust them? I mean, really?) or rebuild from the ground-up.
  6. Harden your server using the information you gleaned from the logs post-hack.

You must figure out how this happened. Likely it was some piece of insecure code. Get someone to help you out if you need to, but just rebuilding is going to ensure that this happens again.

1
  • 1
    It's just an automated scan.
    – user9517
    Aug 4 '11 at 19:30
1

EDIT: As others have noted, the logs indicate it's just a scan. I'll leave this here as a quickie guide for hack recovery though.

My hacking-disaster-plan:

  1. Shut down server
  2. Make a dd-copy of the server's HDD
  3. Rebuild the whole thing
  4. Use the HDD to recover log files if you do not have a backup and analyze your weak points

Turning the server off might be difficult for you (VPS) so get a quick backup and kill it with fire.

3
  • 2
    It may be counter productive to get a backup post-hack, unless you mean to use it for analysis. For data recovery, not so much... Aug 4 '11 at 19:28
  • @Bart Silverstrim: True, edited for clarity. Aug 4 '11 at 19:31
  • If you absolutely must recover files from an image of a hacked server you need to examine them with a microscope.
    – voretaq7
    Aug 4 '11 at 19:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.