There have been a number of attacks on Unix servers over the recent weeks. A lot of you probably know about this already or maybe, like us, one of your servers fried. So, if you already know about this, then ignore this post. But if you haven't heard, then keep reading.
The attacks are coming from outside your server. Have you noticed your server acting sluggish or rebooting a lot.? When you look at the bandwidth logs to see if there is some outsider using your server as a relay, you won't see any impact on the bandwidth.
What you will see is your server's resources being eaten up, until the machine crashes. You need to take those crashes very seriously. Do not ignore them because sooner or later the OS is going to fry.
First thing ... you better make back-ups and fast. Find out if your back-ups are just of the data or if they include the server's OS. Ours included the OS and so, that got hosed too! If it's just the data, you should be in good shape. All you need to do is make sure the back-up is current and not on the same hard drive as the primary hard drive.
Secondly ... if you report this attack on your server and your systems admins do nothing, pay somebody to help you! Don't bother arguing with them, you can deal with moving hosting companies after you resolve the attack.
If you have cPanel on your server, when you log into the main panel you should see warning messages that read something like this:
Security Notice:
A security vulnerability was discovered in cPanel which may result in privilege escalation. This vulnerability can be resolved by updating your cPanel software here. The necessary patch will occur automatically on all servers during the daily execution of upcp. If cron jobs have been disabled on your server, then you should manually update your cPanel software.Security Notice:
There are several known Linux kernel exploits which may allow local privilege escalation. These exploits have become commonplace in recent weeks and can be avoided by ensuring that your kernel is updated to the latest available version. While cPanel will help ensure your system services and software are up to date, kernel updates are outside the scope of cPanel. Kernels with known vulnerabilities include, but are not limited to, 2.6.9-22 and 2.6.9-34. Please check your running kernel for updates periodically. This will help ensure the overall integrity of your server and data.
You need to follow the directives of these security warnings immediately.
The attack is on your server's kernel and it is relentless. We notified our systems admins about it weeks before it finally froze the OS. Unfortunately for us, we got hosed ... our hosting company had recently sold to a less experienced company and the result was less than acceptable. The systems admins we unable to figure out what was eating up the resources. Needless to say we switched hosting companies and avoided the fly-by-the-seat-of-your-pants cheap hosting solutions. There are times when it pays off to have a solid hosting company there to help you.
Our theory is that these attacks are a form a terrorism. They're having a definate financially negative impact on businesses. We'd like to see something done about it ... so, Big Brother if you're reading, please make the bad people stop.
![](http://www.searchfeed.com/rd/AffiliateInfo.jsp?p=38743&trackID=X2135125436"><img src="http://www.searchfeed.com/Images/banners/aff120x60.gif" border='0'){kind=link}
![](https://secure.revenuepilot.com/jsp/home.jsp?id=16964"><img src="http://www.revenuepilot.com/userimages/referralbanners/120x240.gif" border="0" width="120" height="240"){kind=link}