Про взлом моего вирт. сервака

У меня – виртуальный выделенный сервер (то есть виртуализованный компьютер, где я имею полномочия сисадмина). Там стоит линукс - Centos 3.1. В общем в один день мне на домен одного из сайтов пришло мыло (на имя юзера - совпадающее с паролем) с содержанием типа "привет, дурак!". Но ничего страшного хакеры не сделали, слава Б-Гу. Оказалось что в дистрибьютиве Centos (срок поддержки которого 5 лет по безопасности) забыли включить заплатки для дыр на вебадминку.

Ниже приведено мыло хостеру (переводить лень).


Attacker's IP was 69.93.130.130.

The've logged in into webmin, downloaded some code to /usr/lib/mem, downloaded and compiled some modified openssh, installed it (at least md5sum of /usr/sbin/sshd was wrong when we've checked it today with rpm -V ). They also have probably modified webmin code (or it was modified) - md5 was also different according to rpm -V. But the file modification times of webmin files and sshd looked OK - they were dated 2005.

Though now we have partial impression that they just guessed the root password somehow. But there were too few attempts to guess password in the /var/log/secure ) .Also they didn't clear /root/.bash_history after themselves. And they've sent us email with text 'Hillo5 f503' to the email OUR_OLD_ROOT_PASSWORD_HERE@ZZZZZ.com (that was redirected to our mailbox by remote server since ZZZZZ.com is an affiliated company to us). We've updated webmin and openssh.

According to http://webmin.com/security.html webmin 1.121 that was install on our host had various security issues, that probably were abused. Though immediately after discovering hack-in, we've tried to do up2date -u webmin - but it turned out that most current version has been installed on our computer. Probably Centos 3.1 lacks some updates..

Also usermin has been running - may be it was abused..

Only me can login to this host as root, I didn't tell root password to anybody. I've noticed hackin by pressing "up" in bash (while trying to repeat a command I've run previously) - and it showed commands I never executed. So I studied the logs and found breakin.

Хостер предлагал переставить все нахрен, чтобы была 100% что все чисто, но я не стал этого делать. Вроде все нормально, никаких червей и троянов не видно до сих пор.. Вот уж блин Centos подкозлил..

Это было 16 апреля 2007.