My server got compromised . . . next steps?

[Lithium381]

I got a message from a website saying an IP owned by me was making MANY MANY ssh connections and asked me to stop. I logged into that box and found that one of the accounts I had created for ftp access had been compromised. In that folder there were mb upon mb of password lists ie

root root123
root password
root p@ssw0rd

etc. . .

i put a filter outbound on my firewall to reject all SSH outbound from that server and 8,552,655 ssh attempts were made over the course of about 5 minutes.

lithium381@ftpserver:~$ uptime
16:06:36 up 50 days, 4:40, 3 users, load average: 499.75, 331.11, 156.79

seems to be based on a cron job somehow since first thing i did was change that users password and it still went off, lasted about 5 minutes and then disapeared, but there are HUNDREDS of files all over


first steps?

 

[Pantlegz]

I would do what you should have done initially and block anything incoming that you don't need coming in, or allow only a few ports you do need and block the rest. Same with outgoing ports. Don't just block SSH out...

 

[Lithium381]

I would do what you should have done initially and block anything incoming that you don't need coming in, or allow only a few ports you do need and block the rest. Same with outgoing ports. Don't just block SSH out...

Only required services were turned on / allowed past the firewall. That's FTP and SSH. I think it was a weak password on one of my accounts which may be very common that allowed this to take place. How do I recover other than wiping and starting over?

 

[seepy83]

Only required services were turned on / allowed past the firewall. That's FTP and SSH. I think it was a weak password on one of my accounts which may be very common that allowed this to take place. How do I recover other than wiping and starting over?

Unless you can do a proper forensic investigation to confirm that your box isn't still rooted, backing up your critical data, wiping, and starting over are probably the best option at this point.

 

[Chiefcrowe]

I agree with this, unfortunately I think the best bet is to start over.

Unless you can do a proper forensic investigation to confirm that your box isn't still rooted, backing up your critical data, wiping, and starting over are probably the best option at this point.