Go Back   cPanel Forums > cPanel® and WHM® (for Linux® and FreeBSD® Servers) > cPanel and WHM Discussions
server hacked.... server hacked....
Register FAQ Calendar Search Today's Posts Mark Forums Read

Reply
Page 1 of 2 1 2
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 06-14-2003, 04:06 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
Angry server hacked....
Hello All,

From last few days the server load is continuously running between 25% - 75%. Someone has hacked into the server sending mail. Is there some way we can tract this and shut them out.

6166 root 0 3.2 0.5 sendmail
6173 root 0 3.2 0.5 sendmail
6175 root 0 3.0 0.5 sendmail
6180 root 0 3.0 0.5 sendmail
6187 root 0 3.0 0.5 sendmail
6163 root 0 2.9 0.5 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx2.mail.yahoo.com219R55Q-0003AL-00
6182 root 0 2.9 0.5 sendmail
6190 root 0 2.9 0.5 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx2.mail.yahoo.com219R55R-0003AU-00
6194 root 0 2.7 0.5 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx2.mail.yahoo.com219R55P-0003AE-00
5595 nobody 0 2.5 3.8 httpd
6155 root 0 2.5 0.5 sendmail
6186 root 0 2.5 0.5 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx2.mail.yahoo.com219R55T-0003Al-00
6158 root 0 2.3 1.0 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx2.mail.yahoo.com219R55S-0003AZ-00
6160 root 0 2.3 0.5 sendmail
6165 root 0 2.3 0.5 /usr/sbin/exim-MCS-MCP-MCremote_smtpmx1.mail.yahoo.com219R55V-0003At-00


Thank you,

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 06-14-2003, 04:42 AM
Registered User
  
Join Date: Jun 2002
Posts: 100
tekdns
Did you upgrade your kernel to latest version?

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 06-14-2003, 05:47 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
I am using 2.4.18-27.7.x version of kernel.

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 06-14-2003, 05:48 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
This was upgraded long time back...

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 06-14-2003, 05:53 AM
Registered User
  
Join Date: Jun 2002
Posts: 100
tekdns
You have lost your root pass posible.

You must upgrade to latest kenel, becouse you have not latest kernel version.Your kernel version has a vulnerable.

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 06-14-2003, 05:56 AM
Registered User
  
Join Date: Jun 2002
Posts: 100
tekdns
Yýu can use this comand;
up2date --nox -f kernel

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 06-14-2003, 06:07 AM
Registered User
  
Join Date: Jun 2002
Posts: 100
tekdns
Server Security Guide - Basic steps to server security
http://www.admin0.net/security/introduction.htm

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 06-14-2003, 06:25 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
Does this mean my server is been hacked.

Is there any way to track who is sending mails from my server?

Thank you,

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #9 (permalink)  
Old 06-14-2003, 10:10 AM
Registered User
  
Join Date: Apr 2003
Posts: 22
NightHawk
Re: Server Security Guide - Basic steps to server security
Quote:
Originally posted by tekdns
http://www.admin0.net/security/introduction.htm

cPanel.net Support Ticket Number:
nice link...I will put this in my list of links to give to new admins....

cPanel.net Support Ticket Number:
__________________
NightHawk
We Make Server Management Easy!
http://www.easyservermanagement.com
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #10 (permalink)  
Old 06-14-2003, 10:12 AM
Registered User
  
Join Date: Apr 2003
Posts: 22
NightHawk
Quote:
Originally posted by mitul
Does this mean my server is been hacked.

Is there any way to track who is sending mails from my server?

Thank you,

cPanel.net Support Ticket Number:
the information you have provided is not enough to show for certain that your server has been hacked, certainly if your server was hacked...they could then send that email...but, there are other options:
1) insecure formmail.pl (or clones)
2) compromised customer smtp password
3) compromised customer webmail account
4) open relay (I am guessing you have checked this already).
5) there are others...but those are the ones I would check first).

cPanel.net Support Ticket Number:
__________________
NightHawk
We Make Server Management Easy!
http://www.easyservermanagement.com
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #11 (permalink)  
Old 06-16-2003, 02:54 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
The server is been tested for open relay.

The formmail.cgi bug was fixed few days ago by cpanel.

If is about clients smtp or webmail password been compromised how do I trace that out.

Please help me fast....

Thank you,

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #12 (permalink)  
Old 06-17-2003, 10:01 AM
Registered User
  
Join Date: Feb 2003
Posts: 291
mitul is on a distinguished road
I got my server tested from ORDB.org for open relay and got confirmation from ORDB.org that my server does not permit open relay.

How do I trace if its the local client on the server who is sending mails through script or using any other form?

Please help I am loosing my server....

Thank you,

cPanel.net Support Ticket Number:
__________________
Mitul
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #13 (permalink)  
Old 06-17-2003, 11:23 AM
Registered User
  
Join Date: Sep 2002
Posts: 579
NNNils
Quote:
Originally posted by tekdns

You must upgrade to latest kenel, becouse you have not latest kernel version.Your kernel version has a vulnerable.
What vulnerabilities does 2.4.18-27.7.x have?

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #14 (permalink)  
Old 06-17-2003, 03:49 PM
Registered User
  
Join Date: May 2003
Posts: 1
gncuster
2.4.18+ vuln
IIRC anything <2.4.21 has a ptrace root whole open.

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #15 (permalink)  
Old 06-18-2003, 12:32 AM
Registered User
  
Join Date: Mar 2003
Posts: 863
sexy_guy
2.4.18-27.7.x is not vuln at all. Show me where it says that this kernel is vuln? So many people have had problems with the next kernel release that many have chosen to stay at 2.4.18-27.7.x. If he was hacked he should be looking at his other security admin abilities.

cPanel.net Support Ticket Number:
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply
Page 1 of 2 1 2

« What kicks in port sentry config changes? | Bandwidth for parked domains is not updated »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -5. The time now is 05:20 AM.


Powered by vBulletin® Version 3.8.2
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
© cPanel Inc