How to know hidden FTP account ?

[NaSOnWeb]

Hi...
I Just realised that my web server has been hacked... I think it is for a warez FTP use...
I would like to know if there are some hidden FTP accounts on my server.

is it possible by SSH ?...

is there some FTP logs with all FTP activity on the server ? (where ? )


thank's a lot

 

[InderS]

Hello,

You can check FTP logs in : /usr/local/psa/var/log/xferlog : file, Also I will suggest you change all FTP and panel password of your hacked account. And install LMD (Linux Malware Detect) on your server and scan your whole server. Maybe any shell scripts is uploaded on your server and hacker is using that file to upload any files on your server.

 

[NaSOnWeb]

thank's
The problem was an old vulnerability on plesk. All my accounts password has been changed, and the last plek update is ok now...
which is weird is that I do not have any tracks of FTP access on the warez files on my server...
the files was created in april but no tracks of activity ...
did you know how i can found tracks of this intrusion ? and above all, how can I list the accounts (FTP, ssh ...) on my server to verify if there is some hidden accounts

thank's

 

[InderS]

Hello,

You can find out all System Info (FTP Login info) from Pleak panel DB, Pelase try with the following command

mysql -u admin -p`cat /etc/psa/.psa.shadow`

use psa;

And enter the following command you will get the all info of your user.

select * from sys_users;

 

[NaSOnWeb]

hi,
thank's a lot. It works and nothing bad in view...
So the last thing I would like to verify is the linux system accounts. (If I've understood , this command show me only FTP accounts)
is there a way ?
thank's

 

[NaSOnWeb]

ok, I've found the command line

cut -f 1 /etc/passwd -d:

here are my sys users... Do you see something strange ? thank's

root
daemon
bin
sys
sync
games
man
lp
mail
news
uucp
proxy
www-data
backup
list
irc
gnats
nobody
libuuid
syslog
bind
sshd
mysql
psaadm
popuser
mhandlers-user
psaftp
sw-cp-server
alias
qmaild
qmaill
qmailp
qmailq
qmailr
qmails
hspc
sso
drweb
horde_sysuser

 

[NaSOnWeb]

I Just found this info
http://serverfault.com/questions/73319/sftp-logging-is-there-a-way

does that mean that SFTP connexions are not loged ? I should be for this reason thaat I don't see any tracks of the warez folder on my FTP logs /opt/psa/var/log ?

thank's