2

Just like the title asks, what can I do to protect against infection by the Apache Linux/Cdorked.A backdoor?

2

to check if you're compromised:

strings /path/to/httpd | egrep open_tty

if grep returns ANY line, you're compromised.

it looks like the mode of breakage is via brute force ssh. So best practices to protect your server is: disable the root account, use sudo, and disables ANY user that has /bin/bash login, AND enforce good passwords or no passwords at all and use ssh keys.

1

As Marcel says good password policy is a must in any case.

ssh keys is a fantastic idea, (and) disabling password login on sshd is also great but often not practical.

see: ssh-copy-id (or you can do it by hand) FWIW I set up different key pairs for almost every account.

Also consider a detection software like rkhunter , chkrootkit or some other tripwire type tools.

Finally run monitoring tools like monit. (many others)

These tools can be configured to checksum most any file and scream on alterations to sizes permissions restarts etc etc.

Some quickly googled refs:

http://www.debian.org/devel/passwordlessssh

http://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/

  • 1
    Why would you say that disabling password logging with SSH is impractical ? If you know how to do it, it's a 5 minute job. If you don't, it's a (one-time) 30 minutes job, including downloading putty and setting up your private key. I didn't downvote you because your other advises are sane but frankly, I think you should do a reality check on forcing SSH logon with a public key. – Stephane May 1 '13 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.