0

So ... i've been been unfortunate with my linux VPS server running 12.04.3 lts. I had a bad php script running that basically opened up for a mysql injection. And because of a stupid configuration from my side this mysql injection ended with a escalation exploit where the person gained access to everything.

I managed to catch this in time and backed up my stuff and wiped the server.

So, i've re-installed and re-evaluated everything i thought i knew and started from scratch.

What do i have running ... well.

  • apache2 2.2.22
  • php5 5.3.10-1ubuntu3.8 with Suhosin Patch 0.9.10)
  • mysql-server
  • postfix
  • ssh
  • iptables

I've installed all of these individually, i didn't do "apt-get install lamp". apt-get install ssh apache2 mysql-server php5 php5-mysql postfix iptables ... is pretty much it i think.

For apache2, i've followed a few guides which i can't seem to find among my 300+ tabs in firefox. I'm sure there must be some more stuff i need to do to fully secure apache.

For php5 i made sure i installed suhosin patch and i followed a guide or two where i edited the config. I'm sure there must be something here as well that i could do to protect myself.

My mysql server is set up to only accept from localhost. I use ssh tunnel to be able to connect to it with navicat so i can do backups and such. I've made sure that all users besides root does not have any server privileges, this was what screwed the pooch the last time (yes i know, silly me ... i had completely forgotten that i had used a user in the past to remote connect then used that for something else which then let to the escalation exploit). And i've added a line in the config that stops mysql from being able to load local files into tables and such. Either way ... i feel that i've done what i can with mysql server for now.

Postfix was a default install, i did nothing. I later uninstalled it because i did not find a suitable guide for it. And i saw so many said that postfix is a disaster to configure and if left in default state, you are begging for a hack. Or so they said... shrugs

What i've done so far is secured ssh by running it on a alternative port and i've used puttygen to generate a rsa key with 4096bit encryption with a passphrase. I've disabled root login via ssh config and pam. The only way to log in to ssh now is via the rsa pubkey using the key i generated. And this works really great. And i feel confident that ssh is secure now. No way in without the private key and the password as far as i understand.

iptables, well, every server needs iptables. I have a bunch of ip's i've blocked. And probably more to be blocked in the future.

Alright ... soo, now on my freshly installed server, i've managed to revert almost everything. I have removed the php page that was the entry point for the hacker and i've used a clean install of files for my SMF forum software. I've kept the attachments of the forum though as they were an important part of my forum. Basically i'm ready to boot up my forum with the old database and force all users to change passwords.

Now, the hacker, is a former forum user on my forum. So i sort of know him. He saw hacking my server as a gift to me so i could clean up the security hole. Now this might be so ... it has indeed made me more security aware. So much so that i've spent almost 2 weeks non-stop reading up on the internet about how to secure these services that i am running.

Now, with my freshly installed server, i get a private message over steam from the same guy (the hacker), stating he found another loop hole, but he's not going to tell me what it is this time because i iptabled him and his VPN.

The guy feels that he should be rewarded for breaking into my server. Personally, if a person breaks in, you don't offer him cake and coffee. You break his legs ... then call the cops. coughs

Anyway, this brings me to postfix. I installed this because i don't want to pay for a mail delivery system for my forum when all i need to do is send a few emails a day. It's not a huge forum, so the odd chance is that the only times i will send a lot of emails is when i do newsletters to my 250+ members.

I feel sure that apache, php5 and ssh are secure. And i feel secure that my wordpress frontpage and SMF forum are secure as well (i uninstalled almost all most and went with only the most basic mods). Like i said, all files are fresh but my attachments from the SMF forum.

But i feel that i might be getting trolled here. Though i might be wrong ...

I am in need of a postfix service tho, just so the forum can send mail. I don't need to recieve any. So i'm wondering, can i keep postfix with default settings? Or will these open me for attack?

The guy, like i said, is either trolling me because he wants me to be more paranoid or he's telling me the truth.

Could anyone shed some light here? I mean, apache, php, mysql and ssh seem secure. If there are more php files laying around that he can mysql intject into, then he at least won't get far as none of the users have grant, nor do they have server privileges. So i'm guessing the postfix is his entry point? Or am i just being trolled?

0

They're talking to you over Steam? Talk to the police and ask them to talk to Valve. At the very very least you could hope they lose a Steam account and associated games.

Proactive disclosure is one thing, but making a hole and then saying you can do it all over again is criminal extortion.

Additionally I'd have an introductory conversation with a lawyer for pressing civil action against the user (if identification could be plausible through subpoena). Work out how much your time has been worth and the time for a professional to audit your server (now they've done untold things to it) and multiply that by three and sue them for that.


Security wise, I'd put money on it being one of your sites. Even more so if you've just ripped them off your old installation and stuck them (or their data) on your new server. The attacker has had, one assumes, write access to all your databases. You don't know what rights they have on your sites. It's possible, if not likely given that they're coming back, that they've added new vulnerabilities to conveniently close for you now.

I'd look at service migration. Find a different forum and use that. Check the admin accounts. Check uploaded files and their permissions. Delete abandoned accounts.

In terms of raw access, the only things people can access externally should be the webserver and the non-standard SSH port. Postfix does not need to be externally accessible to send email. And I'd use ufw than trying to manually feed rules into iptables. People make silly mistakes with iptables; ufw is just a lot easier to understand.

Many mailer services (MailChimp for one) have free tariffs for low-usage which it would seem you are within.

You should have fail2ban running so brute SSH attacks are IP-blocked.

Keep better logs and copy them offsite regularly. When somebody has broken in, look for the intrusion. Find out what it was.

I would perhaps go one further and separate out your services. Virtualise your sites into individual containers (docker, lxc, etc). You'll use ~50MB more RAM per site in overhead but one site going down won't tank the server. Quite the opposite, you'll find out which site has the hole.


I feel like I would know what to do in a situation like this but it would take me a lot of time and a lot of stress. I host servers and I've had quite a lot of experience with Ubuntu since I started using it many years ago...

...But even I would consider talking to a professional about auditing my server. You started learning about security two weeks ago. No offence intended, you're out of your depth and you need more than community help.

  • I have one site live. It's running in it's own virtual thingy with the a2ensite command or whatever it's called. The database i've looked over. There are no other admins than me. My password is new. The mysql passwords are new. The SMF forum install is a clean install. The only files i migrated over is the attachment folder which has all the right chmod set and ownership. And no offense taken. I'm not so sure that's he's a good hacker. I just think he dabbles with it and now wants to troll me for iptabling him from accessing the server. Making me paranoid... or whatever it is he wants to do. – user202417 Oct 13 '13 at 22:49
  • I'll have a look at ufw, i saw that in one of my guides but thought it was just an alternative to iptables. I can install fail2ban, but as long as i have set up ssh only to accept keys he would need to get my key. Even then he would need to guess the passphrase or decrypt the key. Then guess the username and later run software which would guess the sudo password. By that time i would see in my logs that activity had been going on i'm guessing. As for lawsuit, i don't see it going this far. He lives in another country. I don't think they give a damn there about this. And it would cost me ... :| – user202417 Oct 13 '13 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.