Blog Update 12/21/08


adamorjames

Member
Joined
Sep 14, 2008
Messages
255
Age
33
Location
Tx
Website
aojweb.110mb.com
Check out the new blog update. http://openpandora.org/blog.php
Thoughts?

EvilDragon said:
Geez, somebody exploited our server and did spam around the world... that's why it was offline so often during the last days.

I have to completely re-setup the server (though I have to wait for Strato to unlock the server first... I hope this doesn't take too long).

I've got backups of everything, so no worries here.

At the meantime, OpenPandora.org moved to a temporary server, however, the gp2x and gp32x File Archives as well as the German forum is still down. If I don't get a response from Strato within the next hours, I'll also move them to a temporary server.

Sorry for the inconvenience...
 
Last edited by a moderator:
adamorjames said:
Check out the new blog update. http://openpandora.org/blog.php
Thoughts?

EvilDragon said:
Geez, somebody exploited our server and did spam around the world... that's why it was offline so often during the last days.
...
Sorry for the inconvenience...

Shit happens?
Even if you try patch up with the latest stuff there is always something you miss....
Maybe considering moving different tech stacks to virtual images?
 
Last edited by a moderator:
Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...

PHP.ini will be setup to be more secure and strict, just might to change some scripts then as they might stop working ;)
 
EvilDragon said:
Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...

PHP.ini will be setup to be more secure and strict, just might to change some scripts then as they might stop working ;)
Lets take a wild guess:

- SQL injection possible ( use placeholders for everything, even what you consider secure variables. This is the number one flaw in way to many sites on the net. ).
- Php: Global still on? ( set register globals off if you are using php, another big one that most people forget )
- No firewall active? Aka, assuming the server is secure because the server is up to date. Use iptables: Block everything expect those ports you need for the website/dns/... ( and ssh ofcourse ;) ).
 
Last edited by a moderator:
Benjiro said:
- SQL injection possible ( use placeholders for everything, even what you consider secure variables. This is the number one flaw in way to many sites on the net. ).
Nope, it was actually PHP this time.

QUOTE

- Php: Global still on? ( set register globals off if you are using php, another big one that most people forget )



Off since years :D
Also safe mode is ALWAYS on.

QUOTE

- No firewall active? Aka, assuming the server is secure because the server is up to date. Use iptables: Block everything expect those ports you need for the website/dns/... ( and ssh ofcourse ;) ).



Yeah, that's what I want to do whenever I can setup the server again (still don't have any access).
Didn't think they would leave it THAT open on initial setup, but they did.

I'll also rename wget (simple but effective, did also work on my old server... a lot of exploits tried to wget but couldn't fine it).
And of course I'll secure PHP more... I'll disable any system() etc. calls.

AND ssh will only reply to fixed IPs in the future!
 
Last edited:
EvilDragon said:
Yeah, that's what I want to do whenever I can setup the server again (still don't have any access).
Didn't think they would leave it THAT open on initial setup, but they did.

I'll also rename wget (simple but effective, did also work on my old server... a lot of exploits tried to wget but couldn't fine it).
And of course I'll secure PHP more... I'll disable any system() etc. calls.

AND ssh will only reply to fixed IPs in the future!
A single fixed Ip is rather dangerous. Its best to just set your iptables ssh port to your providers ip ranges + a few backup ranges ( server ip's you have access to ). Be very careful with that because if in a few years, you change provider, the servers you had access to are down/or dont have any access to them anymore, you may end up shutting yourself out. ;)

Also, move the ssh port away from port 22. Another easy way for people to know what service to access.
Remove root from the ssh login ( to many systems allow root access ). Only login using a user account, and su to the root account when you need to.

Disabling wget or renaming it, is applying a bandage to a open wound. If wget does not work, they can try to use sftp, or any other command. The trick is, to prevent them from executing anything they have no access to. Like you said, the moment they don't have access to system commands like exec, system etc, your backed is secure. Better yet, never use any system, exec calls at all in your code in the first place. :)

If you own your own servers ( in this case, your renting dedicated servers ( Strato < big hint :) )), you can setup a single access ip for ssh ( set up one server to login to, and ssh from that server, to any other servers you have. And setup the other servers to only allow ssh from that one server ). This way, you only expose one server's ssh to the net. But, like i said above, its best to do that when there are your own servers. Aka, you have access to the rack if something goes wrong. Also, disable the bash history. One easy way to see whats possible on a server, is having a quick peek in the bash history. O look, your ssh'ing from this server to xxx ip, aha... The disadvantage is, you also lose the ability to quickly track if somebody has been using that server ( and if they have been foolish not to clear the logs/bash history etc. Very few people will check the logs each time they log in, but a few commands in the bash history that you don't remember executing, now that draws attention :) ).
 
Last edited by a moderator:
Is it known if this was a planned, targeted attack on OpenPandora, or is this just a case of someone who is too antisocial for a drink down a the pub and thus spends their time causing mischief instead? :lol: :lol: :lol:
 
More security hints: you could have a look at shorewall, it's an insanely good firewall software. Forget everything about lenghty iptables config, it all can be written in just a couple of lines in shorewall configuration.

Yes, the manual is a little lenghty, I've spend about 5h one day reading it, but it was few years ago, and since then - it works like a charm. And everytime when my LAN,NAT,internet arrangements change it's crazy simple to update shorewall rules. Just change one word in one line, or sth like that. Great software. It also can detect worms that try to login on ssh and block their IPs :)

Benjiro said:
Remove root from the ssh login ( to many systems allow root access ). Only login using a user account, and su to the root account when you need to.

CODE
PermitRootLogin no
AllowUsers someone someoneelse@example.com
that's in /etc/ssh/sshd_config
;)
 
Last edited by a moderator:
Benjiro said:
A single fixed Ip is rather dangerous. Its best to just set your iptables ssh port to your providers ip ranges + a few backup ranges ( server ip's you have access to ). Be very careful with that because if in a few years, you change provider, the servers you had access to are down/or dont have any access to them anymore, you may end up shutting yourself out. ;)
That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this value ;)
 
Last edited:
EvilDragon said:
That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this value ;)

I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers ;))

(I had to do that when I accidentally did a 'killall -hup sshd' in a foolish attempt to restart sshd after a configuration change. doh!)
 
Last edited by a moderator:
Squidge said:
I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers ;))
It depends, but most IPMI modules allow for those basic actions. Are you using a SuperMicro Server? If you use the cli in the IPMI module, if i remember correctly, you can take over the remote console screen. But! You need to be sure that the output can be redirected ( not the first time i've seen topics about this ).

Never had a need myself for using a IPMI module in the past, but the now i'm working as a freelancer, you can be sure all my servers are going to have IPMI modules ( the 50 euro's / server is not worth the time you can save if you don't need to go to the data center ).

Squidge said:
(I had to do that when I accidentally did a 'killall -hup sshd' in a foolish attempt to restart sshd after a configuration change. doh!)
Hmmmm, yea, killing the ssh demon is going to get you into problems. ;-) Next time, run a chkdsk on a damaged raid set ( ext3 ). And kill your data in the process, now thats going to give you some red cheeks. :) Lucky for me, it was on my server at home.
 
Last edited by a moderator:
EvilDragon said:
Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...
And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck. :)

mechanizeddeath said:
Is it known if this was a planned, targeted attack on OpenPandora, or is this just a case of someone who is too antisocial for a drink down a the pub and thus spends their time causing mischief instead? :lol: :lol: :lol:
Yupp, why we? So many Forums onto the Web...maybe the Pandora gets more and more popular? :D
 
Last edited by a moderator:
Squidge said:
EvilDragon said:
That can't happen - as the server also has a remote console serial board in, so I can login from any server to change this value ;)

I wonder if its the same as the ones I use? You can take over the serial port (i/o), reboot the server by simulating a press of the servers reset button, and even turn the power on/off (I guess the last two were meant for Windows servers ;))

(I had to do that when I accidentally did a 'killall -hup sshd' in a foolish attempt to restart sshd after a configuration change. doh!)
Nope, that's how it works on my old server ;)
On the new one, I've got my own login and password. After that, I can access the console output of the PC. But only with normal commands, no reset :)

fusion_power said:
EvilDragon said:
Yep, the system was OpenSuSE 10.3 with latest patches... still possible to get into a system via PHP or sendmail exploits...
And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck. :)


Well, the problem was: The php.ini script was pretty weak (I checked it with some guys in the IRC).
It was a PHP exploit they used. It wasn't weak enough to get them root access or file access on the server, but using the exploit they could install a small server (running as wwwrun user) which could use the normal sendmail to hammer out spam :(

I changed the config files to make the server much more secure, but Strato won't let me access the server yet (yeah, cool, no 24h support... and it's Sunday, so I have to wait until Monday to get a response from them, yippieh).

I secured the old server a while ago, so that's no problem. And that's where openpandora.org is hosted at the moment (luckily I got the domains hosted elsewhere and can make an immediate DNS redirect).

QUOTE

mechanizeddeath said:
Is it known if this was a planned, targeted attack on OpenPandora, or is this just a case of someone who is too antisocial for a drink down a the pub and thus spends their time causing mischief instead? :lol: :lol: :lol:
Yupp, why we? So many Forums onto the Web...maybe the Pandora gets more and more popular? :D


Well, I know the eMail adress of the user who used the exploit (at yahoo.co.uk), according to some stuff I found on the net he seems to be from Spain.
Gonna send an abuse report to yahoo for sure, however, I don't think much might happen.
Might be a coincidence, might be a direct attack, but as soon as I get the server back I'm gonna make sure it's rock solid.
 
Last edited:
fusion_power said:
And I thought, Linux is as save as Fort Knox? Ok, I don't know much about Linux so I hope the Server can be fixed and better protected. Good Luck. :)

It is. Unfortunately, you have to run some third party software on there, and you have to be aware of security holes in that software too. In this case, considering the exploit was in PHP, it wouldn't really matter what the OS was, it would have still been vulnerable (to what extent however may have depended on the OS and patches applied).
 
Last edited by a moderator:
mechanizeddeath said:
Is it known if this was a planned, targeted attack on OpenPandora, or is this just a case of someone who is too antisocial for a drink down a the pub and thus spends their time causing mischief instead? :lol: :lol: :lol:
Clearly some well-meaning but slightly confused soul wanted to support the ongoing "DOS on Pandora" efforts. :rolleyes:
 
Last edited by a moderator:
Azure said:
Blog post...deleted?
Ah, nope, just need to re-input it.
The blog post was on the new database only and I just finished moving back to the old one :)
 
Last edited:
Back
Top