Re: "sh -i" My server was hacked. How can i found hole on my server?

From: Kövesdán Gábor (gabor.kovesdan_at_t-hosting.hu)
Date: 06/27/05

  • Next message: Raymond Wagner: "running jail with alternate IP" 
    Date: Mon, 27 Jun 2005 12:31:25 +0200
To: Oleg Rusanov <freebsd-amd64@molecon.ru>

    Oleg Rusanov wrote:

    > What is better to do for clean my system?
    >
    >
    >
    You should backup the data You need. You can also save You configuration
    files: httpd.conf, etc. Then make a clean install from disc. The
    intruder could install a rootkit, and modify system binaries. The best
    thing You can do is reinstall everything.

    >How can i found hole on my server?
    >
    >
    >
    It is the harder part.
    1, Check You FreeBSD version in uname -a. Is it up-to-date? Have You
    upgraded to the appropriate security branch? Or does it have some
    security issues?
    2, Think about what network daemons You are using. Check the version
    numbers and look for security advisories on the project homepage and in
    mailing list archives. Does something have a vulnerability?
    3, Now. Check all the homepages You have. There could be somewhere a
    deficiency in point of security? If You use open-source portal projects
    like phpbb You mentioned, look for security advisories on the project
    homepage, or in mailing list archives. If You have custom php code, You
    should examine them.
    4, You can never trust anybody.... Is there local users on the machine?
    They might take a local root exploit if there is such vulnerability. If
    You haven't found the hole so far, You should look for advisories
    again... You should examine every package that You have installed.

    The prevention is extremely important:
    1, Subscribe to freebsd-announce and to freebsd-security-notifications
    and upgrade Your system if necessary.
    2, Subscribe to announce and security lists of *each* software You use
    and upgrade them if necessary.
    3, Place only trusted and secure code to the hosted websites.
    4, If somebody don't need a unix account don't give him one. Or if he
    need, try to minimize the privileges he gets. The most powerful
    protection is to setup a jail environment and using this for giving out
    user accounts.

    Cheers,

    Gábor Kövesdán

    P.S.: I've removed freebsd-amd64 from cc list, since it is related to
    freebsd-security. ***
    <http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications>*
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Raymond Wagner: "running jail with alternate IP"

    Relevant Pages

    • Re: security fixes
      ... disclosure of a security issue, ... Who, on the FreeBSD Core Team, might make the decision ... >> a secure system to have to install from -STABLE snapshots, ... > of course we don't want a person who wants a secure system to install from ...
      (FreeBSD-Security)
    • Re: Asking the experts. . .
      ... First security tip: don't run PHP. ... install portaudit and update your ports when it identifies an issue. ... FreeBSD is likely to perform fine for a wide variety of loads, ... IMAP supports people reading mail from multiple clients, ...
      (freebsd-questions)
    • Re: Abandoned Redhat customer needs advice
      ... > For servers, I favour a minimalist approach (nothing unnecessary, and ... > like the wind even on cheap/old hardware, and is pretty simple to install, ... Keeping up with security updates is very ... I downloaded Freebsd 4.8 some months ago and set it up on a box but have not ...
      (linux.redhat)
    • Re: BSD derivatives
      ... claim that security is a top priority of the FreeBSD project. ... Actually to set the record straight, the ath driver is installed by ... Installed by default meaning the card is recognized during FreeBSD setup ... By "installed by default", I mean you install the system ...
      (freebsd-questions)
    • Re: Security Announcements?
      ... Subject: Security Announcements? ... contained the 'official' statement from FreeBSD, ... "The FreeBSD Security Officers provide security advisories for the ...
      (FreeBSD-Security)