Editing Jbindia VPS Server got hacked and was generation malacious traffic

[[category:KLOXO]]
[[category:Jacob Ballas]]


== Issue  ==
 
The Server mail.jbindia.co.in (Kloxo panel) was disabled/ Null routed By ISP as it was generating malacious traffic .The server was kept down for one day . 

We requested to the ISP with following commitment .

== what we committed ==
 
Once you hand over , we have scheduled to do the following

# Bring down all Services , HTTP, Mail etc
# Perform an root kit and rkhunter test to check the malicous content
# Remove all the malicious content
# Perform hardening as per the attached guideline for Centos which include Iptables , Bastile hardening , Os hardening .
# Perform Penetrating testing via Backtrack and Vulnerability assessment via Nessus .
# Put the server on Nagios Monitoring for performance , Risk assessment and vulnerabilities .


== what we did ==


1. iptables rules activated for outgoing and incomming traffic /etc/init.d/firewall 

http://wiki.lxcenter.org/How+to+secure+your+Kloxo+with+IPTABLES

2. Installed rkhunter ( http://rkhunter.sourceforge.net/ )  and chkrootkit (http://www.chkrootkit.org/ )

checked the server 

3. Changing all world writable web directories protected 

 find /home -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print0| xargs -0 chmod +t 

4. look for all the files and directories with apache user and group ownership. Change to orignal user if required 

 find /home -group apache
 find /home -user apache

== important links ==
 
http://website-security.info/malicious-code-finder

http://mythrobin.com/remove-malicious-code/

https://kb.mediatemple.net/questions/1973/How+to+uncover+malicious+code%7B47%7Dmalware+files