<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Chris,</div><div><br></div><div>Thats a good point about guessing the password, 12 characters strong. There were no user accounts. I have had others inspect the box, with root access, and they could not find the exploit. Greg Kunhert did find some web based exploits that I cannot explain, but he mentioned may or may not be the reason it was hacked.</div><div><br></div><div>No idea on the exploit, or how the box has been compromised. This new box had no domains on it nor any web sites.</div><div><br></div><div>There is no log of a logon, but the allow-hosts file had dozens of illegal ip's.</div><div><br></div><div>I am going to rebuild, from start, with a new root password and we shall see.</div><div><br></div><div>Steve</div><div><br></div><div><br></div><br><div><div>On Jul 26, 2009, at 11:00 AM, <a href="mailto:blueonyx-request@blueonyx.it">blueonyx-request@blueonyx.it</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Message: 4<br>Date: Sun, 26 Jul 2009 07:45:23 -0500<br>From: Chris Gebhardt - VIRTBIZ Internet <<a href="mailto:cobaltfacts@virtbiz.com">cobaltfacts@virtbiz.com</a>><br>Subject: [BlueOnyx:01820] Re: Second Server Hacked<br>To: BlueOnyx General Mailing List <<a href="mailto:blueonyx@blueonyx.it">blueonyx@blueonyx.it</a>><br>Message-ID: <<a href="mailto:4A6C4FE3.8040209@virtbiz.com">4A6C4FE3.8040209@virtbiz.com</a>><br>Content-Type: text/plain; charset=ISO-8859-1; format=flowed<br><br>Steve Davis wrote:<br><blockquote type="cite">It was a new BX install, i had some mitigation installed, like dfix <br></blockquote><blockquote type="cite">and denyhosts.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">No sites, I believe the need for default security that Michael and <br></blockquote><blockquote type="cite">Greg talked about in other posts is critical to BX success.<br></blockquote><br>Steve,<br>Can you give us some more information on how you were hacked? ie:<span class="Apple-converted-space"> </span><br>what, specifically, was compromised? How was entry gained to your<span class="Apple-converted-space"> </span><br>server?<br><br>The best way to prevent a problem like this is to understand the<span class="Apple-converted-space"> </span><br>vulnerability that was exploited.<br><br>Interestingly, we have set up dozens of BX systems and hundreds of BQ<span class="Apple-converted-space"> </span><br>boxes and never (finding wood to knock on now) had a single issue like<span class="Apple-converted-space"> </span><br>this. We've had boxes attacked and hacked due to other reasons (bad<span class="Apple-converted-space"> </span><br>passwords, lax user putting in 777 permissions willy-nilly, exploited<span class="Apple-converted-space"> </span><br>Joomla / OSCommerce / Wordpress / script-du-jour, etc). Never just a<span class="Apple-converted-space"> </span><br>"new install". Which leads me to believe there's something else that<span class="Apple-converted-space"> </span><br>we don't know about in your case(s).<br><br>--<span class="Apple-converted-space"> </span><br>Chris Gebhardt<br>VIRTBIZ Internet Services<br>Access, Web Hosting, Colocation, Dedicated<br><a href="http://www.virtbiz.com">www.virtbiz.com</a><span class="Apple-converted-space"> </span>| toll-free (866) 4 VIRTBIZ</span></blockquote></div><br></body></html>