How to do maintenance check on your server from being hacking

Discussion in 'Security' started by ikwee, Feb 23, 2008.

  1. #1
    Anybody can share with me on how to

    1. know if your server is being hacked
    2. prevent it from happening
    3. restore it
     
    ikwee, Feb 23, 2008 IP
  2. cooldude7273

    cooldude7273 Active Member

    Messages:
    185
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #2
    cooldude7273, Feb 24, 2008 IP
  3. wisdomtool

    wisdomtool Moderator Staff

    Messages:
    15,825
    Likes Received:
    1,367
    Best Answers:
    1
    Trophy Points:
    455
    #3
    I think the most important is to monitor the logs regularly. Also

    1. Patch regularly
    2. Have an IDS to monitor and prevent intrusions.
    3. Check your firewalls' logs
    4. Backup regularly both online and off site.

    Last but not least schedule a PIN test once a year.
     
    wisdomtool, Feb 24, 2008 IP
  4. ThreeGuineaWatch

    ThreeGuineaWatch Well-Known Member

    Messages:
    1,489
    Likes Received:
    69
    Best Answers:
    0
    Trophy Points:
    140
    #4
    The most important aspect is to keep current (daily!) backups of ALL your files and databases, and keep them off your server. There are several strategies for doing this.

    Additionally, before you expose your server to the net you need to make a sha1 hash of all the important files and keep it off site. This way you will know whether files have been tampered with - this is essentially what a host-based IDS does.

    Also, you should run a cron job to check for changes in your OSes cvs tree and also join their security mailing lists. This way you stay current on important updates. It amazes me how many people say they chose Linux because it is "more secure" and then run a version that is several patch levels out of date :-S

    You also need to keep current on all your apps (eg. sendmail, postfix, apache etc.), and web apps (eg: joomla, phpbb etc.)
     
    ThreeGuineaWatch, Feb 29, 2008 IP
  5. maestria

    maestria Well-Known Member

    Messages:
    705
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    110
    #5
    Hi,
    You have all the steps required to do the server hardening at the link maestriatech.com/instruction.php
     
    maestria, Mar 1, 2008 IP
  6. cooldude7273

    cooldude7273 Active Member

    Messages:
    185
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #6
    Some stuff on there is very old and outdated information that I would highly not recommend using.
     
    cooldude7273, Mar 2, 2008 IP
  7. babarhyd

    babarhyd Peon

    Messages:
    9
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Can you tell us which OS are you referring to? BSD and Linux OS'es have different options to Secure/Harden them. Although PHP can be hardened by using h t t p : / / w w w . h a r d e n e d - p h p . n e t
    The most basic tool for checking if your system is compromised is RKHUNTER or CHKROOTKIT.
    For installing IDS try reading stuff from h t t p : / / w w w . c o n f i g s e r v e r . c o m <-- Sadly they dont deal with DirectAdmin Control Panel but it can be customized! Remove Spaces

    And most important of all!
    Daily Updates and Patches are necessary (if available)

    Hope this answers your question.
     
    babarhyd, Mar 3, 2008 IP
  8. cooldude7273

    cooldude7273 Active Member

    Messages:
    185
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #8
    I don't mean to be rude bab, but why did you put spaces in between every character in the links your posted? That's just really annoying to have to delete all the spaces or look and type it in manually if you want to visit the site. Keep the letters together and make it clickable!
     
    cooldude7273, Mar 7, 2008 IP
  9. fbnewtz

    fbnewtz Peon

    Messages:
    160
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Because he does not have enough posts to post urls yet.

    Fred
     
    fbnewtz, Mar 11, 2008 IP
  10. Ladadadada

    Ladadadada Peon

    Messages:
    382
    Likes Received:
    36
    Best Answers:
    0
    Trophy Points:
    0
    #10
    You can still post the URLs without spaces... you just can't put BBCode URL tags around them.

    Hit the "Go Advanced" button and untick the "Automatically parse links in text" option underneath the text box.
     
    Ladadadada, Mar 12, 2008 IP