Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is a logentry, which was executed:

mkdir /root/.ssh/;echo "ssh-rsa <some unkown public-key> > /root/.ssh/authorized_keys

I'm guessing that I was hacked. Any advice for cleaning up (except password change, cleaning of authorized keys)?

share|improve this question
Do you know how they got in? I guess first yank the key out of authorized keys. I'd recommend also disabling direct root login for SSH. Then, I'd try to figure out what vulnerability they exploited to get in to add the key in the first place. Maybe also verify permission/ownership sanity on files in /root. – killermist Apr 15 '13 at 19:36
yes we found it, it was gootkit an old plesk security hole. (it's a friend server, and he is updating the server now.) – noircc Apr 15 '13 at 19:56
up vote 3 down vote accepted

If the machine was compromised, you can not trust anything on it, period. The only sane course of action is to disconnect from the network, do a full backup using a rescue system (probably install media for your system doubles for that). Then install from scratch, making sure you have everything up to date and properly secured. Change all passwords, even irrelevant ones, also passwords for remote sites you used from this computer. If you need some data, store it away and check it carefully before letting it anywhere near the computer again.

You might want to save the original disk (or an image) for forensic fun...

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .