Awesome, switch to Plesk and get hacked in a wink...

[RattleSn@ke]

Hello,

Stunned by the moment when I discovered that after I changed from Ensim to Plesk, my server got hacked, cracked or whatever within a few weeks...

Looks like there are hugh security-holes in perl. The infection is (as I believe) the reason why I have hugh amounts of traffic, about 4-5GB in just half an hour...

As attachement the malicous script / files which I discovered in /tmp

Had anyone else this problem? And more interessing: how to get dis-infected and stay like that?!?!?!

Thanks!
Onno.

 

[kram@]

securing /tmp &

Hi there,

I have been hit hard by scripts running rampant in /tmp.

I did 2x things to help get my server back under my control so that I could spend the time to find the real hole and patch accordingly.


1)edit /etc/php.ini
change:
allow_url_fopen = On
allow_url_fopen = Off

run: apachectl graceful

reason: if allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in a PHP querystring. This happend to me time and time again with sites running JOOMLA.


2) Secure the /tmp directory
you can also go here: http://kb.swsoft.com/article_38_1410_en.html

Securing /tmp

The /tmp partition is one the common places for script kiddies and crackers alike to place trojans or scripts. Because of that you should have the /tmp partition mounted noexec. First we need to check if your /tmp is secure.
shell: df -h |grep tmp

If that displays nothing then go below to create a tmp partition. If you do have a tmp partition you need to see if it mounted with noexec.
shell: cat /etc/fstab |grep tmp

If there is a line that includes /tmp and noexec then it is already mounted as non-executable. You will also want to check if /var/tmp is linked to /tmp.
shell: ls -alh /var/ |grep tmp

If it shows something to the effect of "tmp -> /tmp/" then you are ok. If not go ahead an remove the old /var/tmp and replace it with a sym link to /tmp.
shell: rm -rf /var/tmp/
shell: ln -s /tmp/ /var/

If you do not have any /tmp partition you will need to follow the directions below to create and mount a partition.

Create a 190Mb partition
shell: cd /dev/; dd if=/dev/zero of=tmpMnt bs=1024 count=200000

Format the partition
shell: mke2fs /dev/tmpMnt

Make a backup of the old data
shell: cp -Rp /tmp /tmp_backup

Mount the temp filesystem
shell: mount -o loop,noexec,nosuid,rw /dev/tmpMnt /tmp

Set the permissions
shell: chmod 1777 /tmp

Copy the old files back
shell: cp -Rp /tmp_backup/* /tmp/

Once you do that go ahead and start mysql and make sure it works ok.
If it does you can add this line to the bottom of the /etc/fstab to automatically have it mounted:
/dev/tmpMnt /tmp ext2 loop,noexec,nosuid,rw 0 0

While we are at it we are going to secure /dev/shm. Look for the mount line for /dev/shm and change it to the following:
none /dev/shm tmpfs noexec,nosuid 0 0

Umount and remount /dev/shm for the changes to take effect.
shell: umount /dev/shm
shell: mount /dev/shm

If everything still works fine you can go ahead and delete the /tmp_backup directory.
shell: rm -rf /tmp_backup

Hope that helps, i know i have not had further issues since then.

 

[DerFalk]

Did you secure your Apache & Co. with mod_evasive or mod_security?

 

[amit290]

Slightly off topic....

What would it mean if I got
mount: could not find any device /dev/loop#

after running:
mount -o loop,noexec,nosuid,rw /dev/tmpMnt /tmp

after following the above instructions?

 

[execubob]

We also got hacked. Trashed everything, even though I hired an expensive security management company to harden the server. Good thing I have a back up service.

 

[danliker]

Originally posted by execubob
We also got hacked. Trashed everything, even though I hired an expensive security management company to harden the server. Good thing I have a back up service.

ask the "expensive security management company"

 

[atomicturtle]

Are you guys astroturfing? You just said the same thing in two separate threads.

 

[modom]

Hi,

I followed your instructions to secure my server better but I'm not understanding how to change the fstab to noexec.

This is my fstab file now:

This is my fstab:

# This file is edited by fstab-sync - see 'man fstab-sync' for details
LABEL=/1 / ext3 defaults,usrquota 1 2
LABEL=/boot1 /boot ext3 defaults,usrquota 1 2
none /dev/pts devpts gid=5,mode=620 0 0
none /dev/shm tmpfs defaults 0 0
none /proc proc defaults 0 0
none /sys sysfs defaults 0 0
LABEL=/tmp1 /tmp ext3 defaults,usrquota 1 2
LABEL=SWAP-sda2 swap swap defaults 0 0

How would I change the tmp to noexec?

Thanks!

 

[Hal9000]

haha this thread is so funny