0

My LAMP server got a virus. (I think.) The root partition started to fill up. But there is no clue as to what it filled up with (no logs). After restart, the used space of the root went back to 4% (as normal). I reinstalled the server, but I saved the old root files to preserve the configuration.

Afterwards, I tried to delete the saved files, it started to disappear only one files I could not delete with root and then something started to build up the whole "old" root file structure again. All the deleted folders came back. I needed to format the drive to get rid of it. Unfortunately I have another copy from this. Do I have to do some kind of security action?

Improve this question
4
  • You should find out what fills /. This SO-question may give you help in finding what uses disk space.
    – vidarlo
    Nov 24, 2017 at 15:49
  • Thanks, I formated the drive. Of course I do not have backup. How can be Linux system compromised?
    – István Radics
    Nov 27, 2017 at 8:32
  • By security hole, or user running code with backdoors. Which is pretty much the same way all operating systems can be compromised.
    – vidarlo
    Nov 27, 2017 at 16:01
  • Hi, I could not locate it with du. It could hows everything with the normal size and could not read some file: { du: cannot access 'proc/1096/task/1096/fd/4': No such file or directory du: cannot access 'proc/1096/task/1096/fdinfo/4': No such file or directory du: cannot access 'proc/1096/fd/4': No such file or directory du: cannot access 'proc/1096/fdinfo/4': No such file or directory } As I remember we managed to located these process with the size of 160 TB. Which is strange. We do not have external storage connection.
    – István Radics
    Nov 28, 2017 at 8:35

1 Answer 1

Reset to default
2

If you believe that your system has been compromised,

  1. Take your system offline
  2. If you intend to do a security analysis, use dd to preserve a copy of your compromised system on a separate safe media. I suspect this is what you mean by a 'security action'. You cannot file a useful security bug until you know what the vulnerability is, so keep investigating on your test system.
  3. Wipe your disk, and reinstall Ubuntu from scratch
  4. Restore your data from backups. DO NOT migrate data from the compromised system

If you don't have backups, then you have just learned an important life lesson.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .