The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Server Wiped on cPanel Updates

Discussion in 'General Discussion' started by i3903, Jul 19, 2007.

  1. i3903

    i3903 Well-Known Member

    Joined:
    Apr 27, 2003
    Messages:
    62
    Likes Received:
    0
    Trophy Points:
    6
    We have a troubled server, which keeps wiping on cpanel updates.
    Once the update starts to run, 'rm' appears on top, and within a few seconds /boot /usr /home / and /etc are wiped completely. It appears something is being triggered (malicious) when the cPanel update starts. We've tried all the normal means to track down the potential issue, and have extensive security in place, but something keeps getting through.

    Does anyone have any suggestions, on where we could look?
     
    #1 i3903, Jul 19, 2007
    Last edited: Jul 19, 2007
  2. DReade83

    DReade83 Well-Known Member

    Joined:
    Oct 20, 2006
    Messages:
    196
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Cheshire, UK
    Please define "extensive" security.

    If you do have an extensive protection sheild in place from the outside world, what about internally?

    Does more than one person have root access?

    Have you checked for any additional root accounts?

    It sounds (to me) like someone or something has coded the rm command into the updater. Perhaps you should log a ticket with cPanel Support to get them to have a closer look.

    Link: https://tickets.cpanel.net/submit/index.cgi?reqtype=tickets
     
  3. DaveUsedToWorkHere

    DaveUsedToWorkHere Well-Known Member

    Joined:
    Dec 28, 2001
    Messages:
    689
    Likes Received:
    1
    Trophy Points:
    18
    Check that your /scripts/ directory has not been hijacked. Specially look at /scripts/upcp, any /scripts/*up or /scripts/post* scripts that are present.
     
Loading...

Share This Page