I've been on yet-another crusade this morning..and have a few questions for the..umm.."general" hosting audience.
We live in odd times. If you told me that script kiddies might be able to completely comprimise a server via php..or that spammers are now using the webserver *itself* to send spam a few years ago..I would have laughed. This is no laughing matter.
A concept of privacy comes into play..and I'm curious how many of you handle it. Joe pays me for a account..agrees to my TOS/AUP..and starts uploading files. The way I see it..we have many ways of dealing with scripts that do bad things. It seems to me, though...this may be considered "spying" on our customers.
If we have a script..say..that runs every fifteen minutes..and looks for these scripts..wouldn't that be considered spying?
Or would this be something we should just bury in our aup/tos that this might happen? I have read and agreed to quite a few of those AUP/TOS things..and I can't remember even one time even a mention that files that I upload to the server may be scanned or inspected..before allowing the file to be placved on the server.
Never..not once.
However...this may have changed. If you've ever tried to get even a simple Perl script to work on a Cpanel server...you probably understand that many safeguards are there for the sake of everybody else on the server...and may prevent you from doing what you want to do with the script(s).
At the same time..though..it seems to fly in the face of common sense that many script packages available today are inherently insecure. Chmod 777 files and directories? Even in the times we live in today and know this is a very, very bad idea?
Yet..there seem to be even more like this today than ever before.
>>I mention this from first hand expereince. One of the many magazines I get had a article detailing the trials the author was having trying to get Simple Groupware working on a vps.
yesterday..I noticed a post with a person wanting something installed on a production server. Not only was the program a beta..but..just like Simple Groupware..looked horribly insecure.
In retrospect...I can remember the very first php script I ever used. The year was 1996..and this was my first Cpanel shared account. I even remember having to add *.php to the mime types.
It installed without a hitch..and..coming from the Perl world I had spent many years in..and many hours getting those scripts to work..it seemed almost like a miracle.
It seems, as hosts, there are a few ways we can go at this.
1) Modify the ftp server so it inspects files
2) Have a program that looks for things..much like rkhunter does.
3) A front-end for all scripts..perhaps MySQL as well..that enforces rulesets..for restricted content..or resource allocations.
I am constantly battling hackers over the last week and I have to admit I'm not really sure what it is that is letting them in, but they're getting in... the processes all run as "apache" so clearly it's the webserver somehow.
I've changed the ssh port, have disabled cron on the apache user and have set php safe_mode on the site I think might be to blame, but still no luck.
We are rookies and we are being attacked by hackers for the second time in as many weeks. I can see them in shell right now on multiple servers. I can not remember in all the excitement how to take away their root access. How do I stop them from doing any more damage?
Twice in about a week mabey 2 weeks my server provider has sent me spoof abuse messages on accounts on my server. These phising pages first linked to a bank then paypal, these phising pages that were placed were on 2 diffrent accounts and the accounts belong to people ive known for a very long time and they wouldnt have any idea how to do this so i know its a hacker getting in somhow.
How can I stop this from happening? Any programs that I can run on the server? Heck even which log files do I check to see where these attacks are coming from would help as I could block the IP's .
I'm running cpanel as well if that helps, i use CSF .
I dont want to have to move servers as that would take a very long time for me.
They fortunately did not do anything exceptionally terrible, but the site was down, they altered the serps results and now my inbox ( operating from Squirelmail ) is now receiving even more spam than before.
A network expert suggested that my server would now be being used for sending spam.
And my company, who will remain nameless atm seem to claim that no server is safe from hackers under any circumstances.
I would like to copy to you the companies response to my questions and I would hope for a word or two of inspiration and encouragement from you?
The second string in each question is the server companies response.
1.Please quote me for checking to see if the server is being used for spam and blocking this from happening.
We could certainly check and see if you server is currently sending out any spam and try to identify where it is originating from. Depending on the issue a fix may be required by your developers
2.Running a check on the sites code to see if there has been any amendments to the coding on the site
We can check and see if there has been any FTP access and look at file modification dates, this would hopefully pick up and issues.
3.Making sure the server is safe and that all China ip ranges are banned.
Whilst we cannot ban all Chinese ranges as we do not know all ranges China uses we can lock FTP and SSH access to certain ranges only, you would need to provide these ranges.
4.Applying a second level of security to stop a spammer from hacking the system ( However I am sure I already have anti virus and spy ware on the server )
I’m not sure you do have any anti-virus/spyware on your server, it is certainly not something we install. I don’t really believe either of those tools would stop someone hacking the server either, Linux server don’t really get affected by that. We could run a rootkit checker which checks for backdoors and modification of the operating system files. We would also suggest making sure the scripts are secure and any web interface (admin area) logins have secure passwords and are also IP restricted.
For the work above we would charge 1 hour support at £150 per hour ex vat.
I am giving few tips on securing your server against hack attempts. You must check these inspite of other securities like firewall, rootkits detectors etc.
1. Most Important, do not disable safe_mode under php.ini. If any customer asks to disable it, turn it off on his account only, not on whole server.
As most of the time attack is done using shellc99 (phpshell) script. In case safe_mode is off on server and there are public dirs with 777 permission, he can easily hack through.
2. Compile apache with safe mode as well.
3. In cpanel under tweek settings, turn on base_dir, if someone requests to turn off, turn it off on his/her account only. As using phpshell one can easily move to main server dirs like /etc, /home.
4. Do not allow Anonymous Ftp on your server. You can turn it off from ftp config under WHM Service Configuration. If its allowed, one can easily bind port using nc tool with your server and gain root access. Always keep it disabled.
5. Make sure /tmp is secured. You can easily do that by running this command /scripts/securetmp using ssh. But do make sure, /tmp is secured. Else one can upload some kind of perl script in /tmp dir and can deface or damage all data on the few/all accounts on your server.
What would you think about creating a big text file with IPs of known hackers, bots and similar "bad" creatures to keep out from our servers? Do you think it's worth it?
One of my servers which hosts 200 domains is being attacked by hacker(s). It seems any world writeable files are being replaced or modified by the linux account nobody. How can I secure this account? Is it safe to change the password? I know many processes depend on using the nobody account to run.
guys im tired off fighting those hackers everyday! i have about 20 websites,and everyday i have one of them hacked! i restore a backup then another one hacked!
thats unbelivable!!!
those bastards upload there shell scripts to websites via bugs or whatever from php files!!
is there anyway to stop these commands?
can .htaccess helps? how?
i talked to my webhosting companies for my websites! ....
how to secure my website from hackers, or anything like that. I host my own website, from a home server and I was wondering what I can do to protect me and my website.
My site is going down lot of times due to high cpu quota and when i check cpu exceeded logs i could see some ip addresses trying to open non existenet permalinks i.e. my site is smartdesis.com and they try to open smartdesis.com/xxx which gives a 404 error which is causinf high cpu usage. Repetedly they are trying to open differnt urls by appending /xxx to them, i banned nearly 100 ips but they seem to be growing.
I've seen perl scripts able to achieve this, so I am wondering if a tool similar to this has been released to work with APF / Iptables?
The script in question is a "bot trap" and you put a deny rule in robots.txt to a hidden file. In that file, the script records the offending IP and blocks it in htaccess (once the file in question is hit by a bot/person).
Getting a bit tired of seeing these morons always searching for: /phpmyadmin /pma etc, etc.
I've been concerned about executing commands through (./) using php and perl shells on the server
a new way of hacking these days is using perl shells , even if the perl was terminated on the server ,, or was forbidden for users hackers upload a (perl) program to the server to use it instead of the server's own perl
any way ,,
chmoding the (ls-cat-more-less) to 4750 seems to give permission denied when exeuting these programs on the server but the hackers also found that they could upload their own ls-cat-more-less programs and use them instead of the server's
they also could rename them ls==>ki or anything and use them like this
./ki /etc/valiases -alXrt and the commands work like charm for them
./ <<--- this command uses the sh program on the server ,, ((sh which refers to bash on most servers)) so
./ki is the same as
sh ki
and
bash ki
so i tried chmoding sh with 4750 and that killed the exploit
i was concerned about cpanel's and the website's functionality so i tried changing an accounts password and creating a database ,, they both worked fine
so ,, if u thing chmoding 4750 sh is a bad idea please let me know
and if you know any other ways of disabling all the perl scripts on the server
ThePlanet.com permitting hackers or just incompetent?
It sort of seems that way. I noticed my former boss's site was redirecting to the searchportal.information.com linkfarm junk site. I knew this was not his site and took a closer look at the link that I saw when I visited his site. I use NoScript in firefox and saw this as as a link on his primary page that the script was trying to make me go to. [url]
This script then redirects me to this junk site. [url]...BDlaBQlSAFADDw I would not recommend going there unless you have Firefox installed with NoScript installed along with Adblock Plus. Who knows what exactly this site may be trying to do. Anyway, I noticed this was happening and took a look at the source of my boss's site as it is now and this is what I get: Code: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <BODY> <script type="text/javascript"> <!-- window.location = [url] //--> </script> </BODY> </HTML> So Java Script is being executed which executes that code located on on ThePlanet.com's service. Using the IP address that is hosting the script, I did a DNS check and come up with this: [url] Quote:
OrgName: ThePlanet.com Internet Services, Inc. OrgID: TPCM Address: 315 Capitol Address: Suite 205 City: Houston StateProv: TX PostalCode: 77002 Country: US ReferralServer: rwhois://rwhois.theplanet.com:4321 NetRange: 216.40.192.0 - 216.40.255.255 CIDR: 216.40.192.0/18 OriginAS: AS13749, AS13884, AS21844, AS30315 OriginAS: AS36420 NetName: NETBLK-THEPLANET-BLK-EV1-5 NetHandle: NET-216-40-192-0-1 Parent: NET-216-0-0-0-0 NetType: Direct Allocation NameServer: NS1.EV1SERVERS.NET NameServer: NS2.EV1SERVERS.NET Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE RegDate: 2000-10-05 Updated: 2008-02-28 OrgAbuseHandle: ABUSE271-ARIN OrgAbuseName: The Planet Abuse OrgAbusePhone: +1-281-714-3560 OrgAbuseEmail: abuse@theplanet.com OrgNOCHandle: THEPL-ARIN OrgNOCName: The Planet NOC OrgNOCPhone: +1-281-714-3555 OrgNOCEmail: noc@theplanet.com OrgTechHandle: TECHN33-ARIN OrgTechName: Technical Support OrgTechPhone: +1-214-782-7800 OrgTechEmail: admins@theplanet.com # ARIN WHOIS database, last updated 2008-12-18 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database.
So I sent ThePlanet.com an email to Abuse@theplanet.com two days ago which is what their tech support phone number told me. This is the email I sent two days ago minus any information that would embarrass my former boss. Quote:
Hi, > > I was taking a look at my former employers website to see if they had done > anything new with it and I saw this happen today. The domain is > website. I would not recommend you going to the site unless you > are using Firefox for a browser and have the NoScript plugin installed. A > perl script tries to automatically redirect with the domain of > [url]. This script automatically forwards to > [url] > . > > I think all that applies to you is that whoever owns the server or account > with IP 216.40.254.78 has been most likely compromised. A support > representative from your company said I must email you regarding this. I > got the contact information from the IP address within the script by looking > it up here: [url]. I also > notice that the entire IP address is compromised. > I have notified the owner of website as they use a different > host (Godaddy) and will need to have their hosting account cleaned up. I suppose it is also possible that someone is using your service for nefarious activities. > > If you have any further questions, please feel free to reply. > > Regards, > Lee
This is the email I got just a few minutes from ThePlanet.com. Quote:
On Thu, Dec 18, 2008 at 10:03 PM, <abuse@theplanet.com> wrote: > > Reference: [ThePlanetAbuse-C30396127D] > > Dear Sir or Madam, > > We appreciate you bringing this to our attention. We feel this issue has already been resolved, as we are unable to access the material in question. > > -- > Regards, > Abuse Department > The Planet > abuse@theplanet.com > [url]
Now if you take a look at the above perl script, it is still there and going to that IP still executes that script and redirects you to the link farm. I replied with this just a few minutes ago. Quote:
You do understand that when you go to the site of website.com it redirects to your one of your servers with an IP of 216.40.254.78. The actual scrip that runs is this one: [url] This then redirects to a link farm located on [url]. You do know that IP is your IP and that it is still there? That IP is one of your according to this: [url]One of two things is happening here.
1. The person who hacked someone else's website (website.com) either owns the server with the IP address listed above or this person hacked this server or.
2. Your server is being used in illegal hacking activity to redirect visitors of other websites to a site who's only purpose is to make money through a link farm.
Either one of those above is unacceptable and to say that the material doesn't exist on your own server when I can see it from here would be an inaccurate statement.
When viewing the source of website.com domain, this is the source HTML. This is very much using your server and hosting service to redirect unsuspecting users to a nefarious website.
yesterday andhrahost.com hacked our WHMCS and sent emails to many of our customer here is the screen shoot ,
[url] [url] he also deleted all admin logs but luckily.i took this screen shoot
Around 2 month back also this happen with us and we even informed OC3 about it but that time also. Mr Alex Ferrari From OC3 networks replied to me and didn't took any action on it.we daily get spam from oc3 networks ip.
regularly they were trying to hack our whmcs and yesterday they did it
i have even sent email to OC3 network and this time also ne reply from them and the hacker,spammer server is still up and selling warez hosting , illigal hosting openly.
Kindly guide me how to proceed to take actions against OC3 netwokrs and against that hostig company who is doing this regurarely.
Any thoughts, or opinions are welcome. Looking for options on how to stop this.
Recently I've started receiving spam that appears to originate from a hosted domain on my VPS. It appears to only be an issue with this website account and not the VPS generally.
I've disabled the IMAP service to ensure the spam was not being sent from the server. The spam continues which leaves the POP email accounts as a possibility or something else.
My hosting provider says it looks like email spoofing.
Someone seems to be using the address at foobar.com to send out spam. The method that he has employed is called email spoofing. Email spoofing is the practice of changing your name in email so that it looks like the email came from somewhere or someone else. However, you need not be concerned.
Individuals, who are sending "junk" email or "SPAM", typically want the email to appear to be from an email address that may not exist. This way the email cannot be traced back to the originator. The spammer is not using our server to send out spam, hence your email address will never be blacklisted.
There is really no way to prevent receiving a spoofed email. Remember that although your email address may have been spoofed this does not mean that the spoofer has gained access to your mailbox.
The following are headers of two spam emails. Both of these addresses are setup as forwarders and not actual email accounts. The spam came to our attention because it is being sent to addresses on foobar.com with headers as also originating from foobar.com
I changed the actual names for privacy host.vpsdomain.com [123.123.123.123] - VPS domain foobar.com - website account on VPS myemailaccount@gmail.com - address foobar forwarders send to
problem with spammers.. i installed bruteforce attack and apf but spammers still trying to use my mail server to spam.. bfa sending me 20-30 warning emails everyday like
Quote:
The remote system 200.83.230.214 was found to have exceeded acceptable login failures on xxxxxx; there was 62 events to the service exim. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command: /etc/apf/apf -d 200.83.230.214 {bfd.exim}
The following are event logs from 200.83.230.214 on service exim (all time stamps are GMT -0600):
this spammers causing to load cpu very hi and freeze my server sometimes.
is there any way i can setup to only allow authenticated users to access the mail server. or any idea..
im not a hosting company hosting my websites and im a poor guy can't hire server admin.. and i have search it on google could'nt found anything..
I was wondering if anyone has any methods to stop spammers? Currently i am keeping watch on the mail queue and making sure nothing unsual. I have in WHM configuration setup to not allow more 200 mail messages per account per hour but for some reason it will hit thousands. WHMCS does seem to suspend them automatically or maybe its because of WHM BUT only when its too late.
I have found some spammer hotlinking to my images to get his site crawled, I have modified the .htaccess to attempt and serve his hotlinking domain with a warning but it does not work...
My actual .htaccess file is the one below (it was created by wordpress automatically):
# BEGIN WordPress <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule>
I dont kmow too much what I am doing, following the tutorial here, http://altlab.com/htaccess_tutorial.html but the problem is that my .htacces already contains something created by wordpress that to me looks like garbage as I don't understand the meaning.
I dont know if I should add the lines inside the <IfModule mod_write.c> or outside them as I have done.
I dont know if it is ok to have two times Rewrite Engine On
PS: When I added the lines I describe above, my site also stopped displaying the images, I had stopped everyone including myself from hotlinking them. I only want to stop certain domain. or even better, my ideal solution is to WHITELIST my domain names (I have two using hotlinkg to those images), but I will settle for blacklist if it is easier.
Have a persistent spammer who kept emailing my clients, even non existent domain accounts and getting the bounced emails to be send to a particular yahoo address. I tried to block in all ways but can't seem to stop him. His spams are from all over the world. Any suggestions?
I was on my visitors on AWstats, and when looking up most of the top IPs (the ones that viewed the most pages), most of them were associated with IANA, and tagged as spam/hacker IPs.
Of course, I've blocked all of those IPs with my .htaccess file, but how can I further protect my server from such threats? How can I rid my server of these spammers/hackers?
Someone posted some code similar to below, I made modifications or two after trying to detect PHP "nobody" users, after dumping a few printenv I found PHP exports PWD when calling an external program such sendmail. Basically the PWD will show the user directory that is coming from, which is enough to detect who is sending SPAM even as nobody! It's not 100% secure in that they could wipe /var/log/formmail but I don't imagine any spam will notice the logger, they presume any cPanel server (or other CP for that matter) is the same.
mv /usr/sbin/sendmail /usr/sbin/sendmail2 pico /usr/bin/sendmail (paste the below code into it) chmod +x /usr/bin/sendmail echo > /var/log/formmail chmod 777 /var/log/formail
#!/usr/local/bin/perl
# use strict; use Env; my $date = `date`; chomp $date; open (INFO, ">>/var/log/formmail.log") || die "Failed to open file ::$!"; my $uid = $>; my @info = getpwuid($uid); if($REMOTE_ADDR) { print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME"; } else {
