Server Hacker

[Moose]

I run a dedicated server over at OVH, which I mainly use for hosting websites (wilth LAMP), games servers and media for myself. Often I will test out things on it like vpns, proxies, virtual machines etc.

Today I noticed while looking through my home folder that two extra users had appeared called rootx and roott, which worried me somewhat especially as looking at their groups rootx was in the sudo group. I of course immediately deleted both users and changed the password of all other accounts and wiped any key files (there weren't any). The two accounts were made 14 days ago.

However the obvious horrifying thought is that a user had sudo access to my machine for 14 days, who knows what they installed with that access, plus any program installed could now give them root access! For starters I went into the web dir and found that b374k had been placed there, this is some kind of server manager that allows code to be executed (great). A proxy for facebook had also been made. Obviously I have deleted both.

Looking through auth.log there is only me logging in for the past month, so I haven't had my password hacked. The thing is how the heck did they do it? I had some rudimentary login scripts on the server that only had basic sql injection protection, could they have installed b374k via that then used it to create users?

What I guess I really need to know is can they simply redo what they did before and gain access again? I would prefer not to have my server ruined if they are more nasty than last time. Is there any log I should check to try and find out how they did it?

 

[AsRock]

where @Easy Rhino when you want him.

 

[Rhyseh]

There are a multitude of ways that your system could have been compromised.

This post is pretty detailed and should guide you down the right path:

http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

Also this post should prove helpful:

http://security.stackexchange.com/q...ver-running-a-lamp-stack-for-commercial-e-com

 

[Moose]

Luckily for me there is nothing sensitive that I would be upset from losing especially as the server is backed up. However I feel the guides suggestion of nuking the server is perhaps too much as I don't want to have to reinstall everything.

 

[remixedcat]

I would have configserver firewall installed on the server. Also HUGE THING... are there any control panels like cpanel/interworx/plesk/etc?
Cpanel has CPHulk and it's awesome

I would also get cloudflare for the web end and it automatically blocks a lot of shady IPs including some proxies, bad VPN endpoints, etc.

I would also request a new IP from the host, althought it might cost a pretty penny if they charge you a "lax tax" for not being proactive enough.

Also I'd set your SSH access to work on key files and not passwords for extra security.
Putty guide: https://www.howtoforge.com/ssh_key_based_logins_putty

 

[Aquinus]

Do you have SSH enabled on port 22 with password auth enabled? That's a vector for an attack and I've known many people (myself included,) that have found people attempting to attack SSH (and with my former boss, succeeded in gaining access.)

I highly recommend switching SSH to a non-standard port, like 60022 instead of 22, then requiring RSA Public/Private key auth for all sessions. Password auth itself is a vector for attack and so it using port 22.

I had some rudimentary login scripts on the server that only had basic sql injection protection, could they have installed b374k via that then used it to create users?

I doubt it. If it were SQL injection it would only impact your database. Side note: That should never be a question. You should *always* handle SQL injection, there is never a time to not handle it.

 

[W1zzard]

Your best option when a server is compromised is a complete reinstall, then copy back your data, making sure that no backdoors have been added. Checking file modification times is a good first step to identify those, you might actually want to run that search on your server to see what files they changed.

like that:
http://stackoverflow.com/questions/...-the-files-have-been-changed-in-last-24-hours

getting root access via sql injection is not impossible, depends on your server setup.

 

[Ahhzz]

I would have configserver firewall installed on the server. Also HUGE THING... are there any control panels like cpanel/interworx/plesk/etc?
Cpanel has CPHulk and it's awesome

I would also get cloudflare for the web end and it automatically blocks a lot of shady IPs including some proxies, bad VPN endpoints, etc.

I would also request a new IP from the host, althought it might cost a pretty penny if they charge you a "lax tax" for not being proactive enough.

Also I'd set your SSH access to work on key files and not passwords for extra security.
Putty guide: https://www.howtoforge.com/ssh_key_based_logins_putty

+1 to that. I had a client who was hacked via RDP a few years ago, and after spending the weekend playing whack-a-hack from the house, blocking IPs via the router, I had the ISP give them a new static ASAP monday morning.

 

[bdiddy]

then requiring RSA Public/Private key auth for all sessions. Password auth itself is a vector for attack and so it using port 22.

This so much. Key auth is the way to go.

You could look into chroot jail, if you are feeling paranoid.

 

[Moose]

Thanks, I'll try setting up private keys and disabling login. Though I don't think they got in via ssh, there are many attempted attacks each day looking at the logs!

Only thing edited of significance were:
/etc/ssh/ssh_config and ssh_config~
/etc/subuid and subuid-
/etc/subguid and subguid-

 

[Aquinus]

there are many attempted attacks each day looking at the logs!

Get off port 22 for SSH. That will resolve 99% of your attacks on SSH. A lot of automated attacks come from machines scanning the internet for ports open on commonly used ports.

Solution: Don't use commonly used ports if possible.

 

[remixedcat]

And did you look into configserver firewall?

 

[Moose]

And did you look into configserver firewall?

Yer I'm looking into it, only thing is that I don't want it to make using the server harder!

 

[remixedcat]

Sometimes it's necessary tho for better security.