My advice? Look in the /tmp/
directory and see of there is anything there that shouldn’t be there. 9 times out of 10 malware on Linux systems will be able to install themselves in /tmp/
.
If you are unsure what should/shouldn’t be in /tmp/
there is an easy—but extreme—thing you can do to clear out the bad stuff. Just run this online in the command line:
rm -rf /tmp && mkdir /tmp && chown root:root /tmp && chmod 1777 /tmp
Or run each command individually like this:
sudo rm -rf /tmp
sudo mkdir /tmp
sudo chown root:root /tmp
sudo chmod 1777 /tmp
Then reboot the server to see if that clears things up. If it does, congrats! But you are not out of the woods yet since it whatever caused the original system can still penetrate your system, it’s only a matter of time before they reinfect you again. Meaning, this cleans up the mess caused by a weakness in your system, but you need to find out what that weak-point might be and harden it.
If your servers are infected, the infection had to come from somewhere. Since the bash
shellshock bug was discovered this past summer, chances are high that your machine was infected by an exploit to the server that took advantage of this bug. You can check to see by doing this running this command from the command line:
env x='() { :;}; echo vulnerable' bash -c 'echo hello'
If you are infected, it would return the following output:
vulnerable
hello
The hello
is acceptable output. The vulnerable
means the verison of bash
installed on the system is vulnerable to “Shellshock” exploits.
So now that we know this version of bash
has a problem, let’s enter the following commands to install an upgrade of bash
.
apt-get update
sudo apt-get install --only-upgrade bash
Once that is all done, run this hack test again:
env x='() { :;}; echo vulnerable' bash -c 'echo hello'
And the output this time should only be hello
. Which means bash
is now solid.
But all of that presumes that the bash
exploit was the issue. If something else happened, something else would need to be done.
1Step 1: Remove the infected machines from the network – heavyd – 2015-01-21T20:25:16.287
3
Take down the servers immediately, and then read this post on serverfault in detail: http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server
– tlng05 – 2015-01-21T21:14:45.260I posted an answer with some basics, but your question does not provide more details. Can you please add more details to your question such as what these servers do that might expose them to malware? Are they web servers or have any web-related functionality that would expose them to the world in a way that would invite infection? – JakeGould – 2015-01-21T21:40:36.660
So you are saying my server has definitely been hacked right? – user410929 – 2015-01-22T01:36:09.697
If you aren't sure, you should assume that it has been hacked until you can be certain that it was a false alarm. – tlng05 – 2015-01-22T17:08:42.987