Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : I believe my server has been hacked. Advice needed!

[hanime]

My CentOS 4.3 (yes it's old) dedicated server seems to always halt and become inaccessible at around 10PM-Midnight everyday. I checked my netstat and found the following:

tcp 0 560 ns2.1337gamer.net:ssh 173-26-2030.client.m:55189 ESTABLISHED

It seems they have SSH access? What can I do to trace this hacker or stop them? Thank you in advance.

[relichost]

Firstly

I'd change your passwords,

Then secure it by limiting who can access the server by IP (so only your ip can access it)

then generate a Key using putty on your PC and make it so only you have that key to access the server.

Other than that I cant think what else to suggest from the information you have provided.

Thanks

[ezyvps]

Originally Posted by abtme

then generate a Key using putty on your PC and make it so only you have that key to access the server.

So this only for using putty to access the server or the key generated from putty can be used by ssh?

Thanks! Jxff

[viGeek]

Disable SSH for non-root users, create an SSH account that you use to su - or sudo.

Take advantage of hosts.deny/hosts.allow to restrict SSH access to particular hosts and deny all others.

Enable additional SSH restrictions, timeouts, maximum attempts before disconnecting etc.

[quantumphysics]

They potentially already have ssh access on an old version of centos that may or may not have local root exploits and you're not planning on a OS reload?

[GameFrame]

Originally Posted by hanime

My CentOS 4.3 (yes it's old) dedicated server seems to always halt and become inaccessible at around 10PM-Midnight everyday. I checked my netstat and found the following:

tcp 0 560 ns2.1337gamer.net:ssh 173-26-2030.client.m:55189 ESTABLISHED

It seems they have SSH access? What can I do to trace this hacker or stop them? Thank you in advance.

The rDNS entry is partial, just due to my curiosity, could you get full rdns entry for that IP. I can then check something for you

[quantumphysics]

Originally Posted by GameFrame

The rDNS entry is partial, just due to my curiosity, could you get full rdns entry for that IP. I can then check something for you

my guess would be 173-26-20something.client.mchsi.com

[GameFrame]

Originally Posted by quantumphysics

my guess would be 173-26-20something.client.mchsi.com

Need full, otherwise it's a guessing game.

[hanime]

Thank you everyone for your suggestions. The first thing I did was changed my root password, disabled FTP, and SSHD. I will try to create users and su to root, and some of the suggestions. I already have a new server up ready to migrate everything over.

Attached is an updated netstat log.

[cd/home]

Originally Posted by hanime

My CentOS 4.3 (yes it's old) dedicated server seems to always halt and become inaccessible at around 10PM-Midnight everyday. I checked my netstat and found the following:

tcp 0 560 ns2.1337gamer.net:ssh 173-26-2030.client.m:55189 ESTABLISHED

It seems they have SSH access? What can I do to trace this hacker or stop them? Thank you in advance.

I think its time you got steven from rack911 on the job