Vai al contenuto





vale&rug

Allarme server memoria e rootkit

Recommended Posts

Ciao ragazzi,

ho un cliente che preso un server cloud, gli ho creato la sua macchina con Centos 64bit con 2cpu, 4gb di ram, 100gb hd e con pannllo Plesk.

Al momento sul server c'è installato solo Magento 1.9.0.0 ed è vuoto, ovvero non ci sono prodotti, non ci sono visite, non ci sono transazioni...proprio lndo post installazione.

Mi arrivano, almeno 10 al gg email come queste:

 

l parametro dello stato del server "Servizi > Utilizzo della memoria Apache" ha cambiato il suo stato da "green" a "yellow".

top - 10:14:40 up 1 day, 8:40, 0 users, load average: 0.03, 0.03, 0.00
Tasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.4%us, 0.2%sy, 0.0%ni, 99.1%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2956664k total, 1912048k used, 1044616k free, 200872k buffers
Swap: 2064376k total, 0k used, 2064376k free, 672920k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 20 0 19232 1564 1264 S 0.0 0.1 0:02.25 init
2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd
3 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
4 root 20 0 0 0 0 S 0.0 0.0 0:00.26 ksoftirqd/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
6 root RT 0 0 0 0 S 0.0 0.0 0:00.30 watchdog/0
7 root 20 0 0 0 0 S 0.0 0.0 1:19.24 events/0
8 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cgroup
9 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khelper
10 root 20 0 0 0 0 S 0.0 0.0 0:00.00 netns
11 root 20 0 0 0 0 S 0.0 0.0 0:00.00 async/mgr
12 root 20 0 0 0 0 S 0.0 0.0 0:00.00 pm
13 root 20 0 0 0 0 S 0.0 0.0 0:00.66 sync_supers
14 root 20 0 0 0 0 S 0.0 0.0 0:00.76 bdi-default
15 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kintegrityd/0
16 root 20 0 0 0 0 S 0.0 0.0 0:02.61 kblockd/0
17 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpid
18 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpi_notify
19 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpi_hotplug
20 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ata_aux
21 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ata_sff/0
22 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksuspend_usbd
23 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khubd
24 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kseriod
25 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md/0
26 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md_misc/0
27 root 20 0 0 0 0 S 0.0 0.0 0:00.00 linkwatch
28 root 20 0 0 0 0 S 0.0 0.0 0:00.05 khungtaskd
29 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kswapd0
30 root 25 5 0 0 0 S 0.0 0.0 0:00.00 ksmd
31 root 39 19 0 0 0 S 0.0 0.0 0:03.39 khugepaged
32 root 20 0 0 0 0 S 0.0 0.0 0:00.00 aio/0
33 root 20 0 0 0 0 S 0.0 0.0 0:00.00 crypto/0
38 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthrotld/0
39 root 20 0 0 0 0 S 0.0 0.0 0:00.00 pciehpd
41 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kpsmoused
42 root 20 0 0 0 0 S 0.0 0.0 0:00.00 usbhid_resumer
73 root 20 0 0 0 0 S 0.0 0.0 0:00.00 iscsi_eh
76 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cxgb4
78 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cnic_wq
79 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 bnx2i_thread/0
92 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kstriped
149 root 20 0 0 0 0 S 0.0 0.0 0:00.01 scsi_eh_0
150 root 20 0 0 0 0 S 0.0 0.0 0:00.02 scsi_eh_1
157 root 20 0 0 0 0 S 0.0 0.0 0:03.69 mpt_poll_0
158 root 20 0 0 0 0 S 0.0 0.0 0:00.00 mpt/0
159 root 20 0 0 0 0 S 0.0 0.0 0:00.00 scsi_eh_2
295 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kdmflush
297 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kdmflush
314 root 20 0 0 0 0 S 0.0 0.0 0:06.32 jbd2/dm-0-8
315 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ext4-dio-unwrit
337 root 20 0 0 0 0 S 0.0 0.0 0:09.34 flush-253:0
395 root 16 -4 11044 1072 320 S 0.0 0.0 0:00.67 udevd
612 root 20 0 0 0 0 S 0.0 0.0 0:03.74 vmmemctl
691 root 18 -2 10652 780 344 S 0.0 0.0 0:00.00 udevd
720 root 20 0 0 0 0 S 0.0 0.0 0:00.00 jbd2/sda1-8
721 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ext4-dio-unwrit
772 root 20 0 0 0 0 S 0.0 0.0 0:00.22 kauditd
775 root 20 0 328m 24m 17m S 0.0 0.9 0:03.28 sw-engine
776 root 20 0 117m 2632 1932 S 0.0 0.1 0:06.39 monit
1286 root 16 -4 27640 824 564 S 0.0 0.0 0:01.66 auditd
1313 root 20 0 243m 2200 1012 S 0.0 0.1 0:01.45 rsyslogd
1340 rpc 20 0 18976 892 640 S 0.0 0.0 0:00.25 rpcbind
1358 rpcuser 20 0 23348 1344 896 S 0.0 0.0 0:00.03 rpc.statd
1380 root 20 0 13580 948 768 S 0.0 0.0 0:08.16 lldpad
1415 root 20 0 45368 1472 296 S 0.0 0.0 0:00.00 sw-cp-serverd
1417 sw-cp-se 20 0 46520 4080 1700 S 0.0 0.1 0:03.07 sw-cp-serverd
1428 root 20 0 66608 1232 516 S 0.0 0.0 0:01.18 sshd
1437 root 20 0 22180 992 752 S 0.0 0.0 0:00.01 xinetd
1450 root 20 0 4068 496 400 S 0.0 0.0 0:00.00 courierlogger
1451 root 20 0 30296 1416 1044 S 0.0 0.0 0:00.02 authdaemond
1456 root 20 0 30296 480 108 S 0.0 0.0 0:00.00 authdaemond
1457 root 20 0 30296 480 108 S 0.0 0.0 0:00.00 authdaemond
1458 root 20 0 30296 480 108 S 0.0 0.0 0:00.00 authdaemond
1459 root 20 0 30296 480 108 S 0.0 0.0 0:00.00 authdaemond
1460 root 20 0 30296 480 108 S 0.0 0.0 0:00.00 authdaemond
1464 root 20 0 4068 380 300 S 0.0 0.0 0:00.00 courierlogger
1465 root 20 0 11904 888 752 S 0.0 0.0 0:00.01 couriertcpd
1473 root 20 0 4068 384 300 S 0.0 0.0 0:00.00 courierlogger
1474 root 20 0 11904 892 752 S 0.0 0.0 0:00.01 couriertcpd
1481 root 20 0 4068 384 300 S 0.0 0.0 0:00.00 courierlogger
1482 root 20 0 11904 884 752 S 0.0 0.0 0:00.01 couriertcpd
1490 root 20 0 4068 380 300 S 0.0 0.0 0:00.00 courierlogger
1491 root 20 0 11904 884 752 S 0.0 0.0 0:00.01 couriertcpd
1502 postfix 20 0 392m 1620 1084 S 0.0 0.1 0:03.37 psa-pc-remote
1529 root 20 0 333m 7820 936 S 0.0 0.3 0:00.25 sw-engine-fpm
1565 root 20 0 11304 1472 1220 S 0.0 0.0 0:00.01 mysqld_safe
1670 mysql 20 0 693m 46m 7272 S 0.0 1.6 1:08.61 mysqld
1743 named 20 0 230m 19m 2552 S 0.0 0.7 0:00.17 named
1986 root 20 0 341m 26m 5252 S 0.0 0.9 0:07.96 sw-engine
1995 root 20 0 528m 2892 968 S 0.0 0.1 0:50.02 sw-collectd
2009 root 20 0 114m 1288 644 S 0.0 0.0 0:00.60 crond
2034 root 20 0 4064 576 496 S 0.0 0.0 0:00.00 mingetty
2036 root 20 0 4064 572 496 S 0.0 0.0 0:00.00 mingetty
2038 root 20 0 4064 580 496 S 0.0 0.0 0:00.00 mingetty
2040 root 20 0 4064 576 496 S 0.0 0.0 0:00.00 mingetty
2042 root 20 0 4064 576 496 S 0.0 0.0 0:00.00 mingetty
2044 root 20 0 4064 572 496 S 0.0 0.0 0:00.00 mingetty
17396 root 20 0 58260 2800 2052 S 0.0 0.1 0:08.26 master
17399 postfix 20 0 58504 2912 2160 S 0.0 0.1 0:04.34 qmgr
17402 postfix 20 0 58340 2816 2096 S 0.0 0.1 0:00.01 tlsmgr
17763 root 20 0 329m 20m 9m S 0.0 0.7 0:02.00 httpd
17765 apache 20 0 229m 6280 476 S 0.0 0.2 0:00.84 httpd
17766 apache 20 0 335m 21m 4960 S 0.0 0.8 0:00.34 httpd
17767 apache 20 0 377m 62m 6064 S 0.0 2.2 0:01.02 httpd
17768 apache 20 0 377m 63m 4676 S 0.0 2.2 0:01.61 httpd
17769 apache 20 0 377m 63m 5936 S 0.0 2.2 0:02.29 httpd
17770 apache 20 0 368m 54m 5928 S 0.0 1.9 0:02.71 httpd
17771 apache 20 0 373m 59m 4484 S 0.0 2.1 0:03.94 httpd
17772 apache 20 0 360m 46m 4888 S 0.0 1.6 0:01.34 httpd
17773 apache 20 0 377m 64m 4892 S 0.0 2.2 0:03.70 httpd
17895 apache 20 0 373m 59m 4676 S 0.0 2.1 0:01.91 httpd
17896 apache 20 0 340m 25m 4316 S 0.0 0.9 0:01.10 httpd
17897 apache 20 0 338m 23m 4408 S 0.0 0.8 0:00.33 httpd
17898 apache 20 0 379m 64m 5844 S 0.0 2.2 0:02.13 httpd
17899 apache 20 0 368m 54m 6028 S 0.0 1.9 0:03.05 httpd
17900 apache 20 0 377m 63m 5160 S 0.0 2.2 0:02.67 httpd
17901 apache 20 0 377m 62m 5908 S 0.0 2.2 0:02.38 httpd
17902 apache 20 0 379m 64m 5680 S 0.0 2.2 0:02.61 httpd
24725 apache 20 0 371m 56m 4360 S 0.0 2.0 0:00.76 httpd
24726 apache 20 0 381m 67m 4612 S 0.0 2.3 0:01.17 httpd
24727 apache 20 0 329m 12m 2160 S 0.0 0.4 0:00.00 httpd
25179 postfix 20 0 58340 2708 1996 S 0.0 0.1 0:00.00 pickup
25197 ftpmsiit 20 0 152m 5632 3180 S 0.0 0.2 0:00.10 in.proftpd
25203 root 20 0 15024 1180 880 R 0.0 0.0 0:00.00 top

 

ed anche email come queste

 

Please inspect this machine, because it may be infected. Scan log:
[01:00:08] Running Rootkit Hunter version 1.3.4 on ruggero
[01:00:08]
[01:00:08] Info: Start date is lun 23 giu 2014, 01.00.08, CEST
[01:00:08]
[01:00:08] Checking configuration file and command-line options...
[01:00:08] Info: Detected operating system is 'Linux'
[01:00:08] Info: Uname output is 'Linux ruggero.local 2.6.32-431.17.1.el6.x86_64 #1 SMP Wed May 7 23:32:49 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux'
........................................................
.......................................................

[01:03:19] System checks summary
[01:03:20] =====================
[01:03:20]
[01:03:20] File properties checks...
[01:03:20] Required commands check failed
[01:03:20] Files checked: 122
[01:03:20] Suspect files: 3
[01:03:20]
[01:03:20] Rootkit checks...
[01:03:20] Rootkits checked : 114
[01:03:20] Possible rootkits: 0
[01:03:20]
[01:03:20] Applications checks...
[01:03:20] Applications checked: 7
[01:03:20] Suspect applications: 1
[01:03:20]
[01:03:20] The system checks took: 2 minutes and 41 seconds

 

 

 


 

Secondo voi è un problema di configurazione del server? Magento? Avete dea di come e se è possibile sistemare?

Grazie!


Imac 21,5" - 3.20 Ghz Intel Core i3

4GB 13333 DDR3 - 1Tb hd

Condividi questo messaggio


Link di questo messaggio
Condividi su altri siti


Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Ospite
Rispondi a questa discussione...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Crea Nuovo...

Info

Per offrirti il miglior servizio possibile il sito utilizza cookies, anche di terze parti e profilazione. Utilizzando il sito acconsenti al loro impiego. Privacy Policy Termini di utilizzo