weird activity...

[roeiboot]

i run Linux RedHat 9.0 on my web server and since 2 days there is constant activity until the point that the pc crashes or at least does not respond to any input from keyboard (screen is black), i nosed around in the current processes but can't really find anything weird.. any one any idea how to approach this issue (btw i'm currently at work and the pc is at home :}

thanks in advance..

 

[Annihilannic]

What kind of activity? CPU or hard drives? Have you looked in top? Try sorting the processes by memory usage as well in case a process has a memory leak.

Annihilannic.

 

[thedaver]

And/Or, if you have the machine hooked up to the Internet, please disconnect it since you might have been hacked.

THEN try to figure out what's right as Annihilannic suggests.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[roeiboot]

thanks guys... yes it's connected to the internet (it's my web server) at this time i have to say it's hard disk activity since that led keeps flashing.

any utils/programs i can run to check if i'm hacked, i thought Linux wasn't that vulnerable..

 

[Trevoke]

Linux isn't that vulnerable, but webservers are vulnerable by default.

Take your web server OFF OF THE INTERNET.

Then do as Annihilannic suggests.

"That time in Seattle... was a nightmare. I came out of it dead broke, without a house, without anything except a girlfriend and a knowledge of UNIX."
"Well, that's something," Avi says. "Normally those two are mutually exclusive."
-- Neal Stephenson, "Cryptonomicon"

 

[dpvone]

What type of hardware is this happening on? Just curious.

 

[roeiboot]

web server OFF the internet and activity continued... i don't see any major things using 'top', when checking with the 'system monitor' huge (as in 150Mb and 300Mb) PERL processes keep popping up, ended those processes and the activity stopped.

few questions/things remain...
1. not sure if i use PERL :}
2. not sure if i need it.
3. is there a way to automatically disable it after a boot up ? if so.. how ?

once again thanks guys.

 

[thedaver]

If you had processes running massive amounts of scripts that you didn't know about, I'd be inclined to guess you were hacked and the scripts were processing spam or something...

Only other thing that grinds that hard from a default setup that I can think of would be 1) software RAID (not a perl script), 2) tripwire building its database.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[Annihilannic]

Try top -c instead to see the whole command line for the perl processes, or try and capture ps www -ef output when they are running to figure out what their parent processes are, what PERL scripts they are running, etc.

Annihilannic.

 

[roeiboot]

i'll have to check that later.. i only run a few small scripts and they have been running for years so i'm probably looking at a hack, damned :}

 

[roeiboot]

i see Perl in the system monitor but not anything abnormal (in my opinion) in top -c nor ps www -ef.. i thought the problem solved itself but slowly but surely (looking in system monitor) the usage of memory used by Perl has climbed to 163Mb...

is there any other way to go about it ? maybe disable Perl for the time being ?

 

[Annihilannic]

Surely you can see from the ps output which PERL script the perl is running? Can you post the output of ps

http://www -ef

| grep perl?

Annihilannic.

 

[pansophic]

You might want to compile on a non-compromised machine 'chkrootkit' with the static option set. Then push that binary onto your Webserver to run there. It will find most rootkits installed on a Linux host.

If you don't have another Linux box around to compile on, boot with KNOPPIX on your Windows desktop and build and compile there, then scp it to your webserver. You can ssh into the webserver and run it from there.

You don't want to compile the binary on a machine that may have been compromised.


pansophic

 

[MonkeyX]

Or you could try one of the live security distros such as helix or auditor. the later being one I have used many times.