sshd rootkit exploit reported

Recently sshd rootkit exploited in cPanel , CentOs, CloudLinux , DirectAdmin, Plesk etc.

Once this happened hackers can steal passwords, ssh keys ,  /etc/shadow and they will get the server access and do spamming in your server.

For 64 bit servers

 /lib64/libkeyutils.so.1.9

For 32 bit servers

 /lib/libkeyutils.so.1.9

For non effected server it should be

[~]# ls -la /lib64/libkeyutils*
-rwxr-xr-x 1 root root 9472 Jan  6  2007 /lib64/libkeyutils-1.2.so*
lrwxrwxrwx 1 root root   18 Aug 24 11:26 /lib64/libkeyutils.so.1 -> libkeyutils-1.2.so*

You can check your server is infected or not using the following command
# wget -qq -O - http://www.cloudlinux.com/sshd-hack/check.sh |/bin/bash

Ajeesh.server10.net #                                                                                                                                                    
Cannot find compromised library

If your server is infected please execute the following command:
# wget -qq -O - http://www.cloudlinux.com/sshd-hack/clean.sh |/bin/bash

Also you can check the integrity of this file using rpm commands , whether there is any patch over written with your existing libkey-utils package.

 root@server [/]# rpm -Vv keyutils-libs-1.2-1.el5
........    /lib/libkeyutils-1.2.so
........    /lib/libkeyutils.so.1
........    /usr/share/doc/keyutils-libs-1.2
........  d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL
........    /lib64/libkeyutils-1.2.so
........    /lib64/libkeyutils.so.1
........    /usr/share/doc/keyutils-libs-1.2
........  d /usr/share/doc/keyutils-libs-1.2/LICENCE.LGPL

From the above output we can see that the package installed on our server is not modified with any patches.

If your output something like
S.5.....    /lib/libkeyutils.so.1

It is vulnerable and you need to update your server as fast as possible.

'YUM', failed

!! The server's system package manager, 'YUM', failed. !!

!!
This is the command that failed: yum --exclude=kernel* -y install

Solution:

I have added kernel* in /etc/yum.conf file and done the following steps.

yum clean metadata
yum clean all

Sphinx Open Source Search Server

Recently i have installed Sphinx search engine in my cPanel server.

]# yum install sphinx.x86_64

Which ended with the following error.

 

Error: Missing Dependency: libmysqlclient.so.15()(64bit) is needed by package sphinx-0.9.9-1.el5.rf.x86_64 (rpmforge)

Error: Missing Dependency: libmysqlclient.so.15(libmysqlclient_15)(64bit) is needed by package sphinx-0.9.9-1.el5.rf.x86_64 (rpmforge)

So i have gone for a manual installation.

1. /usr/local/src/]# wget http://sphinxsearch.com/files/sphinx-2.0.4-release.tar.gz

2. tar -zxf sphinx-2.0.4-release.tar.gz 

3. cd sphinx-2.0.4-release

4. mkdir /var/lib/mysql/plugins

5. cd /usr/local/src/

MySql server for my cPanel server is 5.1.65-cll.

  6. wget http://www.percona.com/redir/downloads/Percona-Server-5.1/Percona-Server-5.1.65-14.0/source/Percona-Server-5.1.65-rel14.0.tar.gz

7. tar -xvzf Percona-Server-5.1.65-rel14.0.tar.gz

8. cd Percona-Server-5.1.65-rel14.0

9. cp -Rf /usr/local/src/sphinx-2.0.4-release/mysqlse/ storage/sphinx

10. sh BUILD/autorun.sh

11. ./configure

12 make

13 cp -rf storage/sphinx/.libs/ha_sphinx.so* /var/lib/mysql/plugins/

14. vi /etc/my.cnf

and add

plugin_dir=/var/lib/mysql/plugins

15. restart your mysql server.

16.

mysql> show engines;

+------------+---------+----------------------------------------------------------------+--------------+------+------------+

| Engine | Support | Comment | Transactions | XA | Savepoints |

+------------+---------+----------------------------------------------------------------+--------------+------+------------+

| InnoDB | YES | Supports transactions, row-level locking, and foreign keys | YES | YES | YES |

| MRG_MYISAM | YES | Collection of identical MyISAM tables | NO | NO | NO |

| BLACKHOLE | YES | /dev/null storage engine (anything you write to it disappears) | NO | NO | NO |

| CSV | YES | CSV storage engine | NO | NO | NO |

| MEMORY | YES | Hash based, stored in memory, useful for temporary tables | NO | NO | NO |

| FEDERATED | NO | Federated MySQL storage engine | NULL | NULL | NULL |

| ARCHIVE | YES | Archive storage engine | NO | NO | NO |

| MyISAM | DEFAULT | Default engine as of MySQL 3.23 with great performance | NO | NO | NO |

+------------+---------+----------------------------------------------------------------+--------------+------+------------+

17. mysql> INSTALL PLUGIN sphinx SONAME 'ha_sphinx.so';

Query OK, 0 rows affected (0.06 sec)

18. mysql> show engines;

+------------+---------+----------------------------------------------------------------+--------------+------+------------+

| Engine | Support | Comment | Transactions | XA | Savepoints |

+------------+---------+----------------------------------------------------------------+--------------+------+------------+

|

| SPHINX | YES | Sphinx storage engine 2.0.4-release | NO | NO | NO |

|

ImageMagick install in cPanel/WHM server

First we need to check ImageMagick is installed in the server.

[~]#/scripts/checkimagemagick

missing

[~]#/scripts/installimagemagick

Appending installation info to /usr/lib64/perl5/perllocal.pod

OK

Successfully installed Image-Magick-6.77

1 distribution installed

ImageMagick installed ok

[~]# convert --version

Version: ImageMagick 6.8.0-1 2013-01-24 Q16 http://www.imagemagick.org

Copyright: Copyright (C) 1999-2012 ImageMagick Studio LLC

Features: OpenMP 

WHM -> Software -> Module Installers -> PHP Pecl > click manage
Install a PHP Pecl box type " imagick "and click "Install Now"

[~]#/scripts/restartsrv_httpd

root@ajeesh [~]# /scripts/checkimagemagick

ok

Uninstalling

/scripts/cleanimagemagick

WHM -> Software -> Module Installers -> PHP Pecl and click uninstall Imagick.

Memory set for a Xen Node

After installing a Xen server we need to cap the Xen Node's total Moemory, If it is not set ,the Total memory of the server will assigned to "Domain-0" and we can not add new VPS on this newly created Xen Node.

We can cap the host node memory by editing /etc/grub.conf ,
Suppose we want to cap 512MB RAM then we should add dom0_mem=512m at the end of Kernel parameter.

title CentOS (2.6.18-308.24.1.el5xen)
        root (hd0,0)
        kernel /boot/xen.gz-3.4.4 dom0_mem=512m
        module /boot/vmlinuz-2.6.18-308.24.1.el5xen ro root=LABEL=/
        module /boot/initrd-2.6.18-308.24.1.el5xen.img

After this changed i have rebooted the server.

#] shutdown -r -f now

  Before capping :

[root@server.ajeesh ~]# free -m

total used free shared buffers cached

Mem: 3521 1386 2134 0 148 931

-/+ buffers/cache: 305 3215

Swap: 4094 0 4094

xm info

total_memory : 4094

free_memory : 4

After the capping :

 [root@server.ajeesh ~]# free -m
total used free shared buffers cached
Mem: 512 418 93 0 35 181
-/+ buffers/cache: 200 311
Swap: 4094 0 4094

Xm info

 total_memory : 4094
free_memory : 3013

Can not create VPS in Solsvm Xen

First we need to check the Xen logs here /var/log/xen/xend.log
root@server10.ajeesh]# tail -f /var/log/xen/

VmError: Kernel image does not exist: /boot/solus-vmlinuz

If you found this error simply execute the following commands and your vps get added.

php /usr/local/solusvm/includes/xenkernel.php

Restarting MediaCore service

Please note down the steps to restart the mediaCore service.

Media core default port is 5000

1. change the directory to the installed location :
2. execute this command

source mediacore_env/bin/activate

You will get the Media core Environment

(mediacore_env)

3.

(mediacore_env)root@server [media core installed location]# paster serve --daemon --reload development.ini

Starting subprocess with file monitor

Entering daemon mode

4. root@server [/]# netstat -lpn | grep :5000
tcp 0 0 serverIP:5000 0.0.0.0:* LISTEN 11402/python