The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

LSM Alert problem

Discussion in 'General Discussion' started by limneos, Jun 24, 2007.

  1. limneos

    limneos Member

    Joined:
    Mar 21, 2004
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    1
    hello to all...
    I've recently asked a reinstall on my server, cause I got chkrooted with Torn8

    before and after that chkrooting happened, I was getting several LSM alerts about httpd new listening ports.

    After the reinstall, the server has been working clear until now. (I have done everything in the sticky thread "A beginner's guide on securing your server")
    However, today I got another LSM alert, saying:

    Code:
    This is an automated alert generated from whatever.domain.I.have. This alert is to
    notify the addressed users of new server sockets. New server sockets can
    indicate server-software that has been started on your host, or otherwise
    be an indication to malicious activity. It is advised to review this alert
    and investigate if needed.
     
    Following is a summary of new Internet Server Sockets:
    > tcp        0      0 0.0.0.0:1330                0.0.0.0:*                   LISTEN      28567/httpd -DSSL
    > tcp        0      0 0.0.0.0:1337                0.0.0.0:*                   LISTEN      28561/httpd -DSSL
     
    Following is a summary of a new Unix Domain Sockets:
    no changes to Unix Domain Sockets
    I was away for a while until I saw this message, and when I entered my server, I found the load to be at 2.08 (quite high, I always work around 0.00 to 0.01) and I saw many perl processes running, probably causing the cpu load.
    I also got another LSM alert , but this time it was:

    Code:
    Following is a summary of new Internet Server Sockets:
    > tcp        0      0 0.0.0.0:8000                0.0.0.0:*                   LISTEN      8871/inetd
    I killed all perl processes, I don't know if I did well but the load started to drop at once.
    when I looked for open ports, none of the listed above were open anymore.
    However, my /tmp directory had suspicious files, such as shell.pl (my antvirus at home defined it as Perl/Shellbot.A), bnc.pid , a file which held the pid 28561 of the httpd process I mentioned above, users.db , a file containing the line : U: Administrador , and some other phpx9rg4 random files.
    I'm getting really concerned about this....has someone gained shell access to my server? (yes, huh?)


    Any ideas how to prevent this from happening?
    Thank you in advance
     
    #1 limneos, Jun 24, 2007
    Last edited: Jun 24, 2007
  2. tweakservers

    tweakservers Well-Known Member

    Joined:
    Mar 30, 2006
    Messages:
    379
    Likes Received:
    0
    Trophy Points:
    16
    Before you have killed the process, do you a do a lsof to find the source of the files execution directory? It may be possible that some of your sites are being exploited which gives ways for the files to be successfully uploaded it to the server.
     
  3. limneos

    limneos Member

    Joined:
    Mar 21, 2004
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    1
    thank you, that seems to come up handy...I realized I hadn't installed mod_security, I did this now , hope this could help in general terms.
     
  4. vavayi

    vavayi Member

    Joined:
    Aug 4, 2008
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    1
    Try this

    chown -R named:named /var/named
     
Loading...

Share This Page