Here is a logentry, which was executed:

mkdir /root/.ssh/;echo "ssh-rsa <some unkown public-key> > /root/.ssh/authorized_keys

I'm guessing that I was hacked. Any advice for cleaning up (except password change, cleaning of authorized keys)?

  • Do you know how they got in? I guess first yank the key out of authorized keys. I'd recommend also disabling direct root login for SSH. Then, I'd try to figure out what vulnerability they exploited to get in to add the key in the first place. Maybe also verify permission/ownership sanity on files in /root. – killermist Apr 15 '13 at 19:36
  • yes we found it, it was gootkit an old plesk security hole. (it's a friend server, and he is updating the server now.) – noircc Apr 15 '13 at 19:56

If the machine was compromised, you can not trust anything on it, period. The only sane course of action is to disconnect from the network, do a full backup using a rescue system (probably install media for your system doubles for that). Then install from scratch, making sure you have everything up to date and properly secured. Change all passwords, even irrelevant ones, also passwords for remote sites you used from this computer. If you need some data, store it away and check it carefully before letting it anywhere near the computer again.

You might want to save the original disk (or an image) for forensic fun...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.