I have read the following posts which didn't answered my questions:
- My linux server was hacked. How do I find out how and when it was done?
- How do I know if my Linux server has been hacked?
- and much more...

The server setup was this:
- the Ubuntu server was after a router (Cisco EA6500) and didn't had port forward (uPNP is enabled).
- the stupidest idea was to have a user called user with password user.

Today I entered on the php webeditor which connects by ssh and didn't accepted the password. I found out that the server might have been hacked.

I found the followings:
- all the server files timestamps are changed to my last login date (today)
- there was one cronjob /dev/shm/- /.ICE-UNIX/update >/dev/null 2>&1 added friday
- there was an error on ubuntu start-up that said "error variable ROOT isn't set"

What I did:
- recover password by recovery console
- setting up a small firewall which got some attempts to get into ssh.

- How do i know what has been changed?
- How did they get in if there was no ssh port exposure?

Later Edit: They have left the logs intact and I found out that they entered by ssh and changed the password. There were a lot of ssh login tries over the past weeks. I have reinstalled the system, moved the port, installed a firewall and I'm inspectting the router. It definitely has security holes. Thank you all!

  • 2
    If you have a backup, compare with that everything.
    – peterh
    Aug 11 '14 at 8:44
  • Really SvW? I already said I read ALL the articles on this subject from Stack Exchange websites, including that one you gave me. Aug 11 '14 at 9:07
  • @Peter Horvath: I ran a checksum check comparison with the backup files: rsync --dry-run -v -r -c --delete directoryA/ directoryB/, but nothing was changed. Aug 11 '14 at 10:42
  • Do it from a rescue disk.
    – peterh
    Aug 11 '14 at 11:13

I wouldn't trust that machine anymore, and would reinstall and probably scan for rootkits (some rootkits even survive formatting of a drive).

If you care about security, my personal advice would be to restart fresh.

  • Regarding your question - you really can't know what has been changed. Unless you have everything in a versioning system or manually compare it with a backup.
    – Nomad
    Aug 11 '14 at 8:42
  • I guess I would have to do that. But I would like to know what has been changed, to know the security hole. That's very important. Aug 11 '14 at 9:09
  • Well, you mention the PHP/SSH-login thing, that's likely to be it. Usually these systems have a configuration file, like server.com/configuremystuff.php - attacks are often used against these, as they are well-known and often have security risks. You also mention a very bad username/password, it is likely someone scanned the ports on your server and found a port with SSH active - you said you used some webeditor that connects through SSH, so some SSH port should be active?
    – Nomad
    Aug 11 '14 at 9:16
  • 2
    SSH scans and brute force attacks are extremely common. I get attempts every day. Don't allow root logins, if you're in control of ssh settings.
    – Nomad
    Aug 11 '14 at 9:17
  • but how did they get past the router? the ssh port isn't accesible fron WAN. Aug 11 '14 at 9:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.