LSM Alert problem

[limneos]

hello to all...
I've recently asked a reinstall on my server, cause I got chkrooted with Torn8

before and after that chkrooting happened, I was getting several LSM alerts about httpd new listening ports.

After the reinstall, the server has been working clear until now. (I have done everything in the sticky thread "A beginner's guide on securing your server")
However, today I got another LSM alert, saying:

This is an automated alert generated from whatever.domain.I.have. This alert is to
notify the addressed users of new server sockets. New server sockets can
indicate server-software that has been started on your host, or otherwise
be an indication to malicious activity. It is advised to review this alert
and investigate if needed.
 
Following is a summary of new Internet Server Sockets:
> tcp        0      0 0.0.0.0:1330                0.0.0.0:*                   LISTEN      28567/httpd -DSSL
> tcp        0      0 0.0.0.0:1337                0.0.0.0:*                   LISTEN      28561/httpd -DSSL
 
Following is a summary of a new Unix Domain Sockets:
no changes to Unix Domain Sockets

I was away for a while until I saw this message, and when I entered my server, I found the load to be at 2.08 (quite high, I always work around 0.00 to 0.01) and I saw many perl processes running, probably causing the cpu load.
I also got another LSM alert , but this time it was:

Following is a summary of new Internet Server Sockets:
> tcp        0      0 0.0.0.0:8000                0.0.0.0:*                   LISTEN      8871/inetd

I killed all perl processes, I don't know if I did well but the load started to drop at once.
when I looked for open ports, none of the listed above were open anymore.
However, my /tmp directory had suspicious files, such as shell.pl (my antvirus at home defined it as Perl/Shellbot.A), bnc.pid , a file which held the pid 28561 of the httpd process I mentioned above, users.db , a file containing the line : U: Administrador , and some other phpx9rg4 random files.
I'm getting really concerned about this....has someone gained shell access to my server? (yes, huh?)


Any ideas how to prevent this from happening?
Thank you in advance

 

[tweakservers]

Before you have killed the process, do you a do a lsof to find the source of the files execution directory? It may be possible that some of your sites are being exploited which gives ways for the files to be successfully uploaded it to the server.

 

[limneos]

thank you, that seems to come up handy...I realized I hadn't installed mod_security, I did this now , hope this could help in general terms.

 

[vavayi]

Try this

chown -R named:named /var/named