----- Original Message -----
From: "dnk" <d.k.emaillists (at mark) gmail.com>
To: "BQ List" <coba-e (at mark) bluequartz.org>
Sent: Wednesday, April 11, 2007 5:06 PM
Subject: [coba-e:09532] machine possibly compramised
> Hi there has any one seen this before?
>
> We have a BQ (Nuonce) yummed up to todays date.
>
> We started noticing a funny process running. It is running as ./a
> under the apache user. it seems to open up port 60666 and listen on
> it. Our firewall is keeping that port locked up though other wise and
> it seems like this hack can't get past this point. We cleaned it out a
> few days ago, and well obviously since I am posting it has appeared
> again. We suspect it must be some code being launched through either
> perl or php and praying it is not through the BQ itself), but was
> hoping for the "hail mary" from the list in case someone has had
> simlar experience.
>
>
> Thanks in advance!
>
> dk
>
You might check to see if you have any old version phpbb scripts on your
server.
locate docs/CHANGELOG.html
You might check the log files:
cat /var/log/httpd/access_log | grep php | grep wget
cat /var/log/httpd/access_log | grep php | grep perl
You could check your user dirs for shell.php type files:
ls -la /home/sites/*.*/users/*/web | grep php
ls -la /home/sites/*.*/users/*/web | grep cgi
ls -la /home/sites/*.*/users/*/web | grep pl
For the future, a few things you might change the following:
1. proftpd.conf
Within my proftpd.conf <global> section, I always add:
<Limit LOGIN>
DenyAll
AllowGroup site-adm
AllowUser admin
</Limit>
That stops uploads by non-admin users. Otherwise someone will guess the
password of the, for example, user alex with password of alex, and they
will upload to the user directory and run their scripts from there.
2. you might change the PHP to run in safe mode.
3. chmod 700 /usr/bin/wget
4. chmod 400 /usr/bin/gcc
5. Set the /tmp parition to not allow execution of scripts (although it is
pretty easy to get around that)
----
Ken Marcus
Precision Web Hosting, Inc.
http://www.precisionweb.net