Jump to content

Jbindia VPS Server got hacked and was generation malacious traffic

From TetraWiki
Revision as of 12:46, 8 February 2014 by Biswajit (talk | contribs) (→what we did)


Issue

The Server mail.jbindia.co.in (Kloxo panel) was disabled/ Null routed By ISP as it was generating malacious traffic .The server was kept down for one day .

We requested to the ISP with following commitment .

what we committed

Once you hand over , we have scheduled to do the following

  1. Bring down all Services , HTTP, Mail etc
  2. Perform an root kit and rkhunter test to check the malicous content
  3. Remove all the malicious content
  4. Perform hardening as per the attached guideline for Centos which include Iptables , Bastile hardening , Os hardening .
  5. Perform Penetrating testing via Backtrack and Vulnerability assessment via Nessus .
  6. Put the server on Nagios Monitoring for performance , Risk assessment and vulnerabilities .


what we did

1. iptables rules activated for outgoing and incomming traffic /etc/init.d/firewall

http://wiki.lxcenter.org/How+to+secure+your+Kloxo+with+IPTABLES

2. Installed rkhunter ( http://rkhunter.sourceforge.net/ ) and chkrootkit (http://www.chkrootkit.org/ )

checked the server

3. Changing all world writable web directories protected 

find /home -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print0| xargs -0 chmod +t

4. look for all the files and directories with apache user and group ownership. Change to orignal user if required 

find /home -group apache
find /home -user apache

important links

http://website-security.info/malicious-code-finder

http://mythrobin.com/remove-malicious-code/

https://kb.mediatemple.net/questions/1973/How+to+uncover+malicious+code%7B47%7Dmalware+files

Retrieved from "https://wiki.tetrain.com/index.php?title=Jbindia_VPS_Server_got_hacked_and_was_generation_malacious_traffic&oldid=1565"