adamorjames
Member
Last edited by a moderator:
Blog Update 12/21/08
- Thread starter adamorjames
- Start date
Polossatik
I reject your reality and substitute my own
adamorjames said:
Last edited by a moderator:
Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...
PHP.ini will be setup to be more secure and strict, just might to change some scripts then as they might stop working
PHP.ini will be setup to be more secure and strict, just might to change some scripts then as they might stop working
benjiro
Member
Lets take a wild guess:EvilDragon said:Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...
PHP.ini will be setup to be more secure and strict, just might to change some scripts then as they might stop working
- SQL injection possible ( use placeholders for everything, even what you consider secure variables. This is the number one flaw in way to many sites on the net. ).
- Php: Global still on? ( set register globals off if you are using php, another big one that most people forget )
- No firewall active? Aka, assuming the server is secure because the server is up to date. Use iptables: Block everything expect those ports you need for the website/dns/... ( and ssh ofcourse
).
Last edited by a moderator:
Nope, it was actually PHP this time.Benjiro said:
QUOTE
- Php: Global still on? ( set register globals off if you are using php, another big one that most people forget )
Off since years
Also safe mode is ALWAYS on.
QUOTE
- No firewall active? Aka, assuming the server is secure because the server is up to date. Use iptables: Block everything expect those ports you need for the website/dns/... ( and ssh ofcourse
).Yeah, that's what I want to do whenever I can setup the server again (still don't have any access).
Didn't think they would leave it THAT open on initial setup, but they did.
I'll also rename wget (simple but effective, did also work on my old server... a lot of exploits tried to wget but couldn't fine it).
And of course I'll secure PHP more... I'll disable any system() etc. calls.
AND ssh will only reply to fixed IPs in the future!
Last edited:
benjiro
Member
A single fixed Ip is rather dangerous. Its best to just set your iptables ssh port to your providers ip ranges + a few backup ranges ( server ip's you have access to ). Be very careful with that because if in a few years, you change provider, the servers you had access to are down/or dont have any access to them anymore, you may end up shutting yourself out.EvilDragon said:
Also, move the ssh port away from port 22. Another easy way for people to know what service to access.
Remove root from the ssh login ( to many systems allow root access ). Only login using a user account, and su to the root account when you need to.
Disabling wget or renaming it, is applying a bandage to a open wound. If wget does not work, they can try to use sftp, or any other command. The trick is, to prevent them from executing anything they have no access to. Like you said, the moment they don't have access to system commands like exec, system etc, your backed is secure. Better yet, never use any system, exec calls at all in your code in the first place.
If you own your own servers ( in this case, your renting dedicated servers ( Strato < big hint
)), you can setup a single access ip for ssh ( set up one server to login to, and ssh from that server, to any other servers you have. And setup the other servers to only allow ssh from that one server ). This way, you only expose one server's ssh to the net. But, like i said above, its best to do that when there are your own servers. Aka, you have access to the rack if something goes wrong. Also, disable the bash history. One easy way to see whats possible on a server, is having a quick peek in the bash history. O look, your ssh'ing from this server to xxx ip, aha... The disadvantage is, you also lose the ability to quickly track if somebody has been using that server ( and if they have been foolish not to clear the logs/bash history etc. Very few people will check the logs each time they log in, but a few commands in the bash history that you don't remember executing, now that draws attention ).
Last edited by a moderator:
mechanizeddeath
Member
Is it known if this was a planned, targeted attack on OpenPandora, or is this just a case of someone who is too antisocial for a drink down a the pub and thus spends their time causing mischief instead? :lol: :lol: :lol:
cosurgi
http://janek.kozicki.pl/
More security hints: you could have a look at shorewall, it's an insanely good firewall software. Forget everything about lenghty iptables config, it all can be written in just a couple of lines in shorewall configuration.
Yes, the manual is a little lenghty, I've spend about 5h one day reading it, but it was few years ago, and since then - it works like a charm. And everytime when my LAN,NAT,internet arrangements change it's crazy simple to update shorewall rules. Just change one word in one line, or sth like that. Great software. It also can detect worms that try to login on ssh and block their IPs
Yes, the manual is a little lenghty, I've spend about 5h one day reading it, but it was few years ago, and since then - it works like a charm. And everytime when my LAN,NAT,internet arrangements change it's crazy simple to update shorewall rules. Just change one word in one line, or sth like that. Great software. It also can detect worms that try to login on ssh and block their IPs
that's in /etc/ssh/sshd_configBenjiro said:
Last edited by a moderator:
That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this valueBenjiro said:A single fixed Ip is rather dangerous. Its best to just set your iptables ssh port to your providers ip ranges + a few backup ranges ( server ip's you have access to ). Be very careful with that because if in a few years, you change provider, the servers you had access to are down/or dont have any access to them anymore, you may end up shutting yourself out.
Last edited:
Squidge
Certified Guru
EvilDragon said:That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this value
I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers
(I had to do that when I accidentally did a 'killall -hup sshd' in a foolish attempt to restart sshd after a configuration change. doh!)
Last edited by a moderator:
benjiro
Member
It depends, but most IPMI modules allow for those basic actions. Are you using a SuperMicro Server? If you use the cli in the IPMI module, if i remember correctly, you can take over the remote console screen. But! You need to be sure that the output can be redirected ( not the first time i've seen topics about this ).Squidge said:I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers
Never had a need myself for using a IPMI module in the past, but the now i'm working as a freelancer, you can be sure all my servers are going to have IPMI modules ( the 50 euro's / server is not worth the time you can save if you don't need to go to the data center ).
Hmmmm, yea, killing the ssh demon is going to get you into problems. ;-) Next time, run a chkdsk on a damaged raid set ( ext3 ). And kill your data in the process, now thats going to give you some red cheeks.Squidge said:
Lucky for me, it was on my server at home.
Last edited by a moderator:
fusion_power
Advanced Member
And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck.EvilDragon said:
Yupp, why we? So many Forums onto the Web...maybe the Pandora gets more and more popular?mechanizeddeath said:
Last edited by a moderator:
Squidge said:Nope, that's how it works on my old serverEvilDragon said:That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this value
I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers
(I had to do that when I accidentally did a 'killall -hup sshd' in a foolish attempt to restart sshd after a configuration change. doh!)
On the new one, I've got my own login and password. After that, I can access the console output of the PC. But only with normal commands, no reset
fusion_power said:And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck.EvilDragon said:
Well, the problem was: The php.ini script was pretty weak (I checked it with some guys in the IRC).
It was a PHP exploit they used. It wasn't weak enough to get them root access or file access on the server, but using the exploit they could install a small server (running as wwwrun user) which could use the normal sendmail to hammer out spam
I changed the config files to make the server much more secure, but Strato won't let me access the server yet (yeah, cool, no 24h support... and it's Sunday, so I have to wait until Monday to get a response from them, yippieh).
I secured the old server a while ago, so that's no problem. And that's where openpandora.org is hosted at the moment (luckily I got the domains hosted elsewhere and can make an immediate DNS redirect).
QUOTE
Yupp, why we? So many Forums onto the Web...maybe the Pandora gets more and more popular?mechanizeddeath said:
Well, I know the eMail adress of the user who used the exploit (at yahoo.co.uk), according to some stuff I found on the net he seems to be from Spain.
Gonna send an abuse report to yahoo for sure, however, I don't think much might happen.
Might be a coincidence, might be a direct attack, but as soon as I get the server back I'm gonna make sure it's rock solid.
Last edited:
Squidge
Certified Guru
fusion_power said:And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck.
It is. Unfortunately, you have to run some third party software on there, and you have to be aware of security holes in that software too. In this case, considering the exploit was in PHP, it wouldn't really matter what the OS was, it would have still been vulnerable (to what extent however may have depended on the OS and patches applied).
Last edited by a moderator:
kin
Member
Is the Pandora website based on an open source CMS?
Nopekin said:
Last edited:
Azure
Trust the recursion...
Blog post...deleted?
Ah, nope, just need to re-input it.Azure said:
The blog post was on the new database only and I just finished moving back to the old one
Last edited:
Similar threads
