CSF, cpHulk, all kind of security, and I get hacked.

nourjabi

• September 01, 2013 13:15

Hi everyone, I'm new here, and I hope I posted this in the right location. I have a Dedicated Server from iWeb Servers Canada. Recently I have been attacked from hackers so much, they keep getting in and messing around with my clients Index files using Mass.SH hacks. I installed CSF today ( Had some hard time configuring it and got my self locked out couple times). But fine now. Can you help me figure how those hackers are getting in? Security holes? or something? ps: they managed to clear Secured logs for SSH everytime, so I have no SSH log to see how and where they messed around. thanks a bunch!

• 

  georgeb

  • September 01, 2013 20:37

  CSF has nothing to do with this kind of hack, you have to control anything that is uploaded to your server, control who is using SSH etc. Many things...If you believe that just installing CSF you are safe, you are wrong, CSF is great but you have to control any file that is uploaded to your server. You can use CXS (with Mod Security) from Config Server, or your own scripts, elaborate security inside your server, control who is connected via SSH etc, check logs, inform you when any other is connected root via SSH. There are many things to check, not just wait until the hacker is inside your server. Many things to do...If you don't know to do those things it is better to hire somebody who knows, like this you'll save a lot of money not been hacked.... Regards

  0
• 

  quizknows

  • September 02, 2013 04:24

  Most of the time hackers get in through an outdated website, often joomla or wordpress with old plugins. If they are able to erase root-owned logs, then it is very likely your kernel was old and let an exploit on one hacked site escalate to root priveleges. At this point you need to have your host make a new server with a clean operating system, new kernel, and new root password, and then migrate all of your users to that server. The sites should be scanned for malware by a professional, ideally prior to moving the to the new server.

  0
• 

  24x7server

  • September 02, 2013 08:46

  Basically hacker are using shell scripts to excite any perl scripts on server so you will have to scan your all websites for the shell scripts, You can find out shell scripts through maldet (LMD) scan. Also install [url=http://applications.cpanel.net/configserver-exploit-scanner-cxs/]ConfigServer eXploit Scanner and mod_Security on your server

  0
• 

  Easylife

  • September 02, 2013 08:56

  maybe your computer system has its own problem, and hacker stolen all these files by vicious code,so I suggest that you should reinstall the system.

  0
• 

  cPanelMichael

  • September 02, 2013 12:29

  Hello :) It's a good idea to consult with a qualified system administrator if your server has been rooted. Going forward, the cPanel Security Advisor Addon may be useful for helping you to determine which options you can enable on your system to improve security: cPanel Security Advisor Addon Thank you.

  0
• 

  nourjabi

  • September 02, 2013 12:36

  thanks everyone for your info, i will look into it. and report if any succed:)

  0
• 

  nourjabi

  • September 04, 2013 14:57

  I have worked out few CSF modifications, and ran CSF Security test, and fixed many holes here and there, and seems everything is smooth and all those IPs trying to hack into the server are blocked. :) thanks everyone

  0
• 

  inthukha

  • September 05, 2013 18:07

  Well, i m still suggest you to run clamd, LMD, rootkit hunter as well for detecting exploits. because if they change the logs it means they can do anything if their exploit existing in the system.

  0

Please sign in to leave a comment.