Michael Lazin on 23 Feb 2012 19:33:55 -0800


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Hacked server - recovery

I always install clamav, rkhunter, chkrootkit, and fail2ban on every server I use.  I like to use lsof or netstat to see if there are any strange open network connections.  Running a clamscan of the htdocs directory is a good idea.  It picks up php shells.  You might want to grep your pages for malicious code.  You can grep for iframes/base64/_javascript_ tags.  You also might want to try something like "find -ctime -7" if you were hacked 7 days ago or how many days back you were hacked.  You will definitely want to look at your mail and access logs if you haven't done so already.  If you need help you can contact me on or off list. 

On Thu, Feb 23, 2012 at 9:52 PM, Walt Mankowski <waltman@pobox.com> wrote:
On Thu, Feb 23, 2012 at 06:37:08PM -0500, Eric at Lucii.org wrote:
> I'm trying to recover an Ubuntu-based web server that was hacked.
> It was/is running a 2.x version of OpenRealty that contains more
> vulnerabilities than I could imagine.
>
> The hacker used it to send spam (no surprise.)  I was in a hurry
> so to stop it I just did apt-get remove postfix.  That worked in
> the same way that decapitation cures a headache.
>
> Now that I *believe* I've cleaned up the malicious code and I'd
> like to re-install and turn on postfix again.  Before I do, is
> there a way to either throttle the email output (our expected
> output is a couple of emails a day from the contact form) OR fire
> off an alarm if there are more than <arbitrary low number> emails
> being sent in a single hour?  Perhaps there is yet another
> alternative that I've not thought of?  (So far, I've thought of:
> not re-installing Postfix, replacing the web site code, and moving
> to Tibet.)  I don't have authorization to replace this code yet
> and my wife won't move to Tibet so that's out too... for now.

If you can forward the mail somewhere else, you might want to look at
using nullmailer instead of postfix.  All nullmailer does is relay all
the messages it receives to a smart relay somewhere else.

Walt

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug




--
Michael Lazin

to gar auto estin noein te kai ennai

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug