Is my Server Compromised? - Bash Script loaded through PHP in TMP

[crspyjohn]

I thought I secured TMP when I setup the server but I guess I forgot. Last night I received a notice from LFD about a suspicious file.

lfd[949]: *Suspicious File* /tmp/php5aIKvW [auser1:auser1 (507:508)] - Script, starts with #!

The site is running Glype Proxy, with suphp. When I checked the TMP folder the file was gone (assumed it was auto-cleared and the notice was 2-3 days ago). I deleted the entire tmp folder contents, deleted the site and reuploaded all the files, ran chkrootkit + rkhunter and everything appears alright.

What else should I do to check if my server has been compromised?

 

[LawsHosting]

I'd use php_mod (cli) + mod_ruid + mod_security2, and maybe secure_php (with CB)

See http://help.directadmin.com/item.php?id=247 (especially #1, #2, #7, & #14)

 

[crspyjohn]

I'd use php_mod (cli) + mod_ruid + mod_security2, and maybe secure_php (with CB)

See http://help.directadmin.com/item.php?id=247 (especially #1, #2, #7, & #14)

I will definitely look at that and implement it but is there anything I can do not to make sure my server isn't compromised?

 

[LawsHosting]

You could try rootkit hunter (like you did) and maldetect (look in How-to forum for a tutorial)... But it really depends on what the shell script did/does.

 

[crspyjohn]

You could try rootkit hunter (like you did) and maldetect (look in How-to forum for a tutorial)... But it really depends on what the shell script did/does.

Tried both and server appears to be fine. Wish I caught the email sooner, my php script clears tmp every 6 hours so I wasn't able to see what was inside it. Guess I'll just do a server reformat this weekend =/

 

[24x7server]

Install Linux Malware Detect on your server and setup the cron for the scanning

http://www.rfxn.com/projects/linux-malware-detect/

Check this : http://forum.directadmin.com/showthread.php?t=42393&p=216079#post216079

 

[chatwizrd]

Thats not gonna find anything.

 

[Richard G]

Maybe not for this problem, but it could always be the case that the server is also infected with malware somewhere.
It's a wise thing to install maldet in any case.