2 problems (Security and Backup)

V

Voland

Verified User
Joined
May 21, 2005
Messages
63
Hi PPL!

I have 2 problems!

1-st problem is with Security!
A week ago my servers were hacked! Somebody got access to /tmp and var/tmp directory and runs scripts from there under apache user.

I backed Up all my data and reinstalled server using following steps:

- Fresh installed FreeBSD 5.4;
- secured the /tmp and var/tmp directory with noexec ........
- Installed DA
- installed the mod_security;
- changed apache, mail, ftp, majordomo users to sbin/nologin in password and master.password.
also I've installed the avtoconfiguretor script from www.rootkit.nl
which installs: Chkrootkit, Rootkit Hunter, cvsup and changes crontab permissions.

After few days one of my servers was hacked again!
At this time, atacker uploaded some tool im my var/mail directory, untar and ran it from there under apache user.

uploaded tool looks like IRC bot/daemon (maybe)

I have no firewall installed, because i dont know how to.
I tried to install it according the HOW-TO from this forum but with no success. also I'm afraid to install it because i don't have direct access to my servers and afraid to block myself.

2-d problem is that I have 62 users on my other server but in backup section of reseller level i see only 42 users and there is no file - users.list in my /usr/local/directadmin/data/users/admin/
and all users owned by admin.

I use FreeBSD 5.4 / customapache with gettext and Freetype2

Thank you and Sorry for my English.
Hope you will be able to help me.
 
chmod any binaries not needed , eg. fetch,wget,lynx.
enable open_basedir
configure mod_security (more then default rules and set php in http.conf to a handler)
disable passthru in php.ini
disable register_globals in php.ini

few more things you may consider doing but can cause problems
chroot apache (can be done easier method with mod_security)
enable php safemode
make 0 byte files of the filenames they uploaded and of cause dont allow them to be overwritten.
check your logs and often to see whats going on and how they may have got in.
 
10x for reply

Can you write little HOW to?
Im Newbe and need step by step instructions what to do!
 
I usually call "hacked" when user get better user privileges...
the attacker in this case probably just got to use some vulnerable PHP script to save programs on your world-writtable directories... no need to worry
just kill and chmod 000 those files and try to find the vulnerable script

or find someone to secure/audit your server
 
Re: 10x for reply

Voland said:
Can you write little HOW to?
Im Newbe and need step by step instructions what to do!
Click to expand...

no because the best way for you to learn is to google read docs and read more docs, this way you become fluent in it and will be better at making your servers secure.
 
Since I have close to zero experience with FreeBSD the only reason I'm adding to the thread to point out that if you got hacked, and thought you cleaned it, but then got hacked again a few days later...

then you probably never got the hack off your server and should probably start over from a clean OS install.

Jeff
 
I will do some instructions later but it will depend on what freetime I have, and I wont include my mod_security ruleset instead just reference other sites. Incidently all the tips I said apply to linux and bsd.
 
Hi there, just a quick question about whether to have register_globals on or off in php.ini...

for security reasons it is better to have them 'off', but I read another post on the forum where squirrelmail apparently stopped working if they are not 'on'. John (from DA_ suggested to switch register_globals on in that post, and in fact they are on by default in a fresh DA install.

So how big is the risk here?

Thanks for pointers - there is so much response for both sides, I am confused...

Harro
 
There is a risk. I haven't tried it recently. If Squirrelmail works now with it off maybe we can have it switched of by default.
 
You must log in or register to reply here.
Back
Top