Sponsored Content
Full Discussion: Server has been compromised
Special Forums Cybersecurity Server has been compromised Post 302756677 by franx47 on Wednesday 16th of January 2013 09:31:32 AM
Old 01-16-2013
@jmanel. Thank you very much for your nice guide.

Is there any possibility I can secure my VPS server without re-install ? Since it has many webhost domain in it and each has huge database for more than 5 years.

You are right, using RKHunter has no effect at all, except just giving any vulnerabilities information.

Today, I was trying again to clean my server from any malicious IRC script, such as:

- Closing port (113,6667,7000)
- Trace process and kill it
- Remove the IRC script files
- Lock any user account that has been compromised, also change my root password
- Give no shell access to all accounts, only root & mysql have /bin/bash
- Scan multiple times with RKHunter and ClamAV to make sure there's no left over malicious files & security hole
- Restrict SSH access to only from spesific IP Address and also disable Authentication Key
- Chmod all domain host directory to 700, set subdirectory to be 755, and only images folder has 777 file permissions. Other files only has 644 file permission.
- Update Centos 5 with yum, almost every day.

I did that procedures above all day long, but after several hours later, in my /root there appears again malicious IRC files with uid and gid 1000. It really makes me pain .. how can the attacker enter my server. I guess he did "rooting" my server.

Did the attacker exploit the /tmp or /dev. I dont know.

Please anyone, whoever expert in Linux security help me on this case.

Thank you.
 

9 More Discussions You Might Find Interesting

1. IP Networking

in.telnetd[5115] -- compromised?

/* Linux Slackware */ looking in my logs I see tons of entries similar to below. Does anyone know what these mean, and should I be concerned. I looked up a few of the IP's at Arin.net and saw that many of them belong to isp's (not good).. Any information is helpful.. Body of Messages log... (1 Reply)
Discussion started by: LowOrderBit
1 Replies

2. Solaris

NFS write failed for server.....error 11 (RPC: Server can't decode arguments)

Hello! I have a Linux nfs server (called server100 below) with a export nfs. My problem is that the Solaris client (called client100 below) doesn't seems to like it. In the Solaris syslog I got following messages (and after a while the solaris client behave liked its hanged/to buzy). Also see... (3 Replies)
Discussion started by: sap4ever
3 Replies

3. Windows & DOS: Issues & Discussions

Office server => laptop =>client server ...a lengthy and laborious ftp procedure

Hi All, I need your expertise in finding a way to solve my problem.Please excuse if this is not the right forum to ask this question and guide me to the correct forum,if possible. I am a DBA and on a daily basis i have to ftp huge dump files from my company server to my laptop and then... (3 Replies)
Discussion started by: kunwar
3 Replies

4. Shell Programming and Scripting

KSH fetching files from server A onto server B and putting on server C

Dear Friends, Sorry for this basic request. But I just started learning Ksh recently and still I am a newbie in this field. Q: I have files on one server and the date format is 20121001000009_224625.in which has year (yyyy) month (mm) and date (dd). I have these files on server A. The task... (8 Replies)
Discussion started by: BrownBob
8 Replies

5. Shell Programming and Scripting

Connect to server-1 from server-2 and get a file from server-1

I need to connect to a ftp server-1 from linux server-2 and copy/get a file from server-1 which follows a name pattern of FILENAME* (located on the root directory) and copy on a directory on server-2. Later, I have to use this file for ETL loading... For this I tried using as below /usr/bin/ftp... (8 Replies)
Discussion started by: dhruuv369
8 Replies

6. Shell Programming and Scripting

Shell script to copy a file from one server to anther server and execute the binary

Hi , Is there any script to copy a files (weblogic bianary + silent.xml ) from one server (linux) to another servers and then execute the copy file. We want to copy a file on multiple servers and run the installation. Thanks (1 Reply)
Discussion started by: Nawrajesh
1 Replies

7. UNIX for Dummies Questions & Answers

Transfer file from server B to server C and running the script on server A

I have 3 servers A, B, C and server B is having some files in /u01/soa/ directory, these files i want to copy to server C, and i want to run the script from server A. Script(Server A) --> Files at Server B (Source server) --> Copy the files to Server C(Target Server). We dont have RSA key... (4 Replies)
Discussion started by: kiran_j
4 Replies

8. Solaris

Script to get files from remote server to local server through sftp without prompting for password

Hi, I am trying to automate the process of fetching files from remote server to local server through sftp. I have the username and password for the remote solaris server. But I need to give password manually everytime i run the script. Can anyone help me in automating the script such that it... (3 Replies)
Discussion started by: ssk250
3 Replies

9. UNIX for Dummies Questions & Answers

Please help my computer has been compromised

Hi everyone, I hope I am posting in the right spot and I really need some help. I am going through a horrible divorce and I am afraid that my husband has compromised . He set up my mac computer and router and for my job set up remote access for me. I caught him cheating on me and I think he... (6 Replies)
Discussion started by: kk243665
6 Replies
AnyEvent::IRC(3pm)					User Contributed Perl Documentation					AnyEvent::IRC(3pm)

NAME
AnyEvent::IRC - An event based IRC protocol client API VERSION
Version 0.96 SYNOPSIS
Using the simplistic AnyEvent::IRC::Connection: use AnyEvent; use AnyEvent::IRC::Connection; my $c = AnyEvent->condvar; my $con = new AnyEvent::IRC::Connection; $con->connect ("localhost", 6667); $con->reg_cb ( connect => sub { my ($con) = @_; $con->send_msg (NICK => 'testbot'); $con->send_msg (USER => 'testbot', '*', '0', 'testbot'); }, irc_001 => sub { my ($con) = @_; print "$_[1]->{prefix} says I'm in the IRC: $_[1]->{params}->[-1]! "; $c->broadcast; } ); $c->wait; Using the more sophisticated AnyEvent::IRC::Client: use AnyEvent; use AnyEvent::IRC::Client; my $c = AnyEvent->condvar; my $timer; my $con = new AnyEvent::IRC::Client; $con->reg_cb (registered => sub { print "I'm in! "; }); $con->reg_cb (disconnect => sub { print "I'm out! "; $c->broadcast }); $con->reg_cb ( sent => sub { my ($con) = @_; if ($_[2] eq 'PRIVMSG') { print "Sent message! "; $timer = AnyEvent->timer ( after => 1, cb => sub { undef $timer; $con->disconnect ('done') } ); } } ); $con->send_srv ( PRIVMSG => 'elmex', "Hello there I'm the cool AnyEvent::IRC test script!" ); $con->connect ("localhost", 6667, { nick => 'testbot' }); $c->wait; $con->disconnect; DESCRIPTION
The AnyEvent::IRC module consists of AnyEvent::IRC::Connection, AnyEvent::IRC::Client and AnyEvent::IRC::Util. AnyEvent::IRC is just a module that holds this overview over the other modules. AnyEvent::IRC can be viewed as toolbox for handling IRC connections and communications. It won't do everything for you, and you still need to know a few details of the IRC protocol. AnyEvent::IRC::Client is a more highlevel IRC connection that already processes some messages for you and will generated some events that are maybe useful to you. It will also do PING replies for you, manage channels a bit, nicknames and CTCP. AnyEvent::IRC::Connection is a lowlevel connection that only connects to the server and will let you send and receive IRC messages. AnyEvent::IRC::Connection does not imply any client behaviour, you could also use it to implement an IRC server. Note that these modules use AnyEvent as it's IO event subsystem. You can integrate them into any application with a event system that AnyEvent has support for (eg. Gtk2 or Event). EXAMPLES
See the samples/ directory for some examples on how to use AnyEvent::IRC. AUTHOR
Robin Redeker, "<elmex@ta-sa.org>" SEE ALSO
AnyEvent::IRC::Util AnyEvent::IRC::Connection AnyEvent::IRC::Client AnyEvent RFC 1459 - Internet Relay Chat: Client Protocol RFC 2812 - Internet Relay Chat: Client Protocol BUGS
Please report any bugs or feature requests to "bug-net-irc3 at rt.cpan.org", or through the web interface at <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=AnyEvent-IRC>. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes. SUPPORT
You can find documentation for this module with the perldoc command. perldoc AnyEvent::IRC You can also look for information at: o AnnoCPAN: Annotated CPAN documentation <http://annocpan.org/dist/AnyEvent-IRC> o CPAN Ratings <http://cpanratings.perl.org/d/AnyEvent-IRC> o RT: CPAN's request tracker <http://rt.cpan.org/NoAuth/Bugs.html?Dist=AnyEvent-IRC> o Search CPAN <http://search.cpan.org/dist/AnyEvent-IRC> ACKNOWLEDGEMENTS
Thanks to Marc Lehmann for the new AnyEvent module! And these people have helped to work on AnyEvent::IRC: * Maximilian Gass - Added support for ISUPPORT and CASEMAPPING. * Zaba - Thanks for the useful input about IRC. * tokuhirom - Thanks for patches for the kick event. * Kazuhiro Osawa - Thanks for the documenation fix. COPYRIGHT &; LICENSE Copyright 2006-2009 Robin Redeker, all rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.10.1 2011-03-01 AnyEvent::IRC(3pm)
All times are GMT -4. The time now is 04:55 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy