KCLUG

kclug@kclug.org

10 participants
3256 discussions

RE: Server Saga
by Geoffrion, Ron P [ITS] 26 Feb '05

26 Feb '05

First, I don't know much about the business relationship, so this is all speculation. But I do see opportunity for $$, justified (pardon my politics) by fear, uncertainty and doubt about security. After all, they were hacked, files missing, and down for over a day. Who knows what else, forensics was not performed, only recovery. You said you manage the site. I presume you get paid. They didn't pay you enough to keep current with software versions. Their bad. But that is tempered by the understanding they had when they entrusted the site to you, do you 'own' the security? Did you give them assurances? Or was it overlooked and now a problem. If you have time (if you don't, subcontract it), figure out what needs to be done to update the box to current standards, including the web pages/apps (if you do those, or even if not) and send them a total estimate. They will 'negotiate', but mostly they need to understand: _this_must_be_done_ to prevent recurrence. They will pay if the website draws business to them (read: $$$$). Temper this suggestion by how important is it to them. I see money in your future with a serious reason for doing so [security]. Please include a monthly fee to stay current on software/apps (15-20% maintenance). You will take care of them better if they pay as a monthly customer, your relationship will be more important both ways. If you are doing it for a co-worker/friend/family or such, then I wouldn't be so harsh. But for arms length business arrangements, I'd say cha-ching. And it would be money well spent (on both sides). Ron ________________________________ From: kclug-bounces(a)kclug.org on behalf of Jonathan Hutchins Sent: Fri 2/25/2005 5:42 PM To: kclug(a)kclug.org Subject: Re: Server Saga On Friday 25 February 2005 05:22 pm, Geoffrion, Ron P [ITS] wrote: >> One plan I think is rather valuable is to simply run the server and >> watch it very carefully. > That would make it a honey pot in production. I would advise more active > measures (if you have access/control/contact over the > network/firewalls). I'm open to suggestions; I certainly didn't imply that was the _only_ thing I'd be doing. I do need to maintain the server in production; I do not control the firewalls but they are well managed. _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

2 1

RE: Server Saga
by Brian Densmore 26 Feb '05

26 Feb '05

Well, I'm no expert, but... since you apparently had already been hacked prior to the reinstall (evidenced by the rm -rf /), I would wager that your reload from the image you have here is already rooted. Of course it could also be that the cracker is watching the system and actively rooting it, so that when you re-installed whatever method was previously used to crack the system was used again in short order. So, in either case I think a little research is in order to determine how to keep this particular bad guy out. > -----Original Message----- > From: Jonathan Hutchins > > ... I reformatted the filesystem and restored an image > I had here via > rsync. By the next morning when someone was available to put > it back on-line > the restore had completed. > > We got the system up and running again, and I restored > configuration changes > while the client restored HTML. By lunchtime everything was > back in good > shape. > > > I haven't done much with it since, but as I was getting ready > to reboot after > a kernel update this morning, I did a 'ps ax' and saw somethng called > "rootedoor" running. > (http://vil.mcafeesecurity.com/vil/content/v_128116.htm > for info on rootedoor.) I went ahead with the reboot and it > vanished, leaving > no aparant trace. I immediately started checking for suspicious and > modified files. >

3 2

Re: Trojan Found
by Brian Kelsay 25 Feb '05

25 Feb '05

Did you finally restore from backup or something? I didn't hear how you got it back up. You said it was in AZ or someplace far away. Just curious what got you to the point you could talk to the machine. These kind of stories are like trashy novels for geeks. Brian Kelsay >>> Jonathan Hutchins <> 02/25/05 01:50PM >>> I found a trojan running on my server today - rootedoor (http://vil.mcafeesecurity.com/vil/content/v_128116.htm). Couldn't find much information about it on the web. If you know anything specific about it (not general speculation on rootkits, trojans, etc.), I would appreciate you sharing it with the list. I detected it running as one of the last two processes listed by 'ps ax' just before a reboot to install a new kernel; the reboot seems to have eliminated all traces of it from the system. I found a number of missing or corrupt Perl modules on the system, but that may not be related, it's an old system and I've had some Perl issues before. This _is_ the system that suddenly lost all it's files Sunday night, so it could have been hacked before.

3 3

Server Status Update
by Chris Bier 23 Feb '05

23 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All, ~ The server seems to be running fine now. The only thing left to fix is the Feb archives. The HTML seems to be borked, but all of the archives are still there. We should have that back soon. Please, let us know if there's something on the site that's not working. Chris - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCHMA5E5xXU3JS1mQRAlvLAKCKm3DmnycVJPpCxJD2cbzU3JA9SwCgqc2K aItRO7W3TvVi+gsYJZKqZYA= =Yj5s -----END PGP SIGNATURE-----

1 0

For us hardware geeks
by Brian Kelsay 22 Feb '05

22 Feb '05

http://catb.org/~esr/jargon/html/S/SCSI-voodoo.html http://catb.org/~esr/jargon/html/E/examining-the-entrails.html Brian Kelsay

1 0

high volume mail server
by Brian Kelsay 22 Feb '05

22 Feb '05

Just noticed that Yahoo uses QMail from this failure notice. I sent something to a bogus address so I can put real addresses in BCC only. With the number of users they have, qmail must be pretty tough. Hi. This is the qmail-send program at yahoo.com. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. Brian Kelsay

1 0

test
by Charles, Joshua Micah (UMKC-Student) 22 Feb '05

22 Feb '05

Is the mail working? Josh

2 1

RE: PHP versus ASP.NET WAS: Test Hosting Recommendation
by Brian Kelsay 18 Feb '05

18 Feb '05

That is exactly what I was thinking after this thread started yesterday. Although I'm not a programmer I am getting into some scripting. I use Wise scripting at work for some things and it is pretty customized to the way you build an .msi, but I suppose like any scripting language it could be used for more than it was originally designed. Anyway, I'm using WiseScript to build an installer for a program called Rational Development Studio and Rational has Perl 5.6.1 as a component that Websphere developers can use. Point being that, as far as I know, Perl works the same on a Winders box as it does on a *nix box. There is that trouble with file paths having the "/" going the wrong direction on Winders, but I'm sure there is a decent workaround in Perl. If I could just read Perl I might understand, but Perl looks to me like some secret code. So, please someone turn Mono/.Net into something positive that is truly multi-platform, multi-language, etc. Don't just give the whole thing lip service and compromise on functionality and principals. That is why I will wait and see before I install either Mono or .Net, unless I absolutely have to. Brian Kelsay >>> "Brian Densmore" <> 02/16/05 04:56PM >>> One more thing. I am all for using mono to embrace .Net and c#. I believe we should take this opportunity to "embrace and extend" .net and c#. We should add features to ..net and to c# to make it better, faster and more useful for the world at large. We should make these features available via GPL. What better way to take away Microsoft market share than by using their own tactics against them. Plus if we add features we can be sure they really do work in cross-browser/platforms, and they are the features that we really want and are useful.

8 15

Server Crashing Question
by Charles, Joshua Micah (UMKC-Student) 18 Feb '05

18 Feb '05

I'm currently working on a php project which I have recently loaded onto the production server. This server hosts several websites (19); my project is only related to one of these. Since I've uploaded this code, their server has crashed repeatedly, after never crashing my development machine. The owner thinks these crashes are related to my code, but admit that it could also be caused by a large increase in traffic over the last few days. Now, all I'm able to really know is my code (written in php). I would nearly guarantee that my code is not causing the problem. The only way, I would say, that it could be doing it would be an over load of the connections to the MySQL server. What I'm looking for is the opinion of someone with more experience administering servers. Is traffic the most likely cause of the problem? Thanks, Josh

4 3

Re: Java and other environments
by Brian Kelsay 18 Feb '05

18 Feb '05

I'll go one better. Java: More than a Headache, Less than a Migraine. Brian Kelsay >>> Aaron Spiegel <spiegela(a)gmail.com> 02/18/05 10:20AM >>> > Java is more than a programming language, but less than an OS. I like that. Java: More than a State Less than a Nation.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG