Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : Major Security Probs

[infernus]

Ive been having some security probs over the last month, and a look at netstat -a appears quite frightening.
Really im looking for someone who will voluntarily help me clean my server of all the insecurities and possible intrusions, so i can start over securing my server properly.
If anyone wouldnt mind lending a hand, PM me here!
Thx alot

[cDedicated.com]

you can email to CEO of linuxdominicana.com his email is: linuxdominicana@gmail.com

he can help you.
will not sure if its free.. but i know they provide full security test for 15$ one time.

[CybexHost]

Good, trusted server security is not free. I'd suggest spending the money necessary to keep your systems in good order.

[infernus]

I just cleared off a script which was connecting to several IRC servers, functioning as bots.... they had been running as user 'nobody'
Im going to use nessus to completely security scan the server, then patch accordingly.
Anything else i should look into?

[Steven]

Chances are if they were running as nobody, then it was an exploited php script, and nessus is not going to tell you anything.

[infernus]

nessus scans for cgi vulnerabilities. Anyways, if this is the case then i will be checking my (insert name of program that lets cgi and php scripts run as the user instead of nobody, i forgot the name ^_^) configuration.

[Steven]

yes but it wont check every domain, and cgi is normally ran as a user not nobody, which leaves php to be the problem.

[infernus]

SuExec is the name:

Notes: suexec allows cgi scripts to run with the user's id. It will also make it easier to track which user has sent out an email. If suexec is not enabled, all cgi scripts will run as nobody.

Does this not include php?

[Steven]

No, you would have to isntall phpsuexec / suphp for php