Security :: Saw A Number Of Clients (customers) With Some Fun Characters Entries On Database?
Feb 16, 2011
My Linux server which is running my company website have been hacked. Today I saw a number of clients (customers) with some fun characters entries on my database. Access denial on really clients. Please assist, am running Linux Ubuntu 9 and I dont know where to start troubleshooting this. let me confession that I am still on the learning curve on Linux
I'm in the process of building a security team and want each individual of the team to concentrate on the GIAC certifications mentioned in the [URL] website. I was wondering if any inputs on how can I structure this team and how can I target customers?
I'm getting duplicate entries in mysql database when submitting a new item from a form. I initially loaded the database via IMPORT function in phpMyAdmin. This is my input form:
Is it possible to show the number of unread Gwibber entries in the me menu? And is it also possible to open Gwibber or Empathy from the me menu? Not just the preferences, but for example for Gwibber the whole window?
In the last week or so, I've frequently been running out of X server client connection slots and getting "Maximum number of clients reached" errors. For example, I'm getting it right now and I'm running 3 pterms, Chrome, and Thunderbird; I've even killed my panel. 'xwininfo -root -children' produces what seems to be an absurd number of X clients (150-ish, when it's able to make a connection), even immediately after Gnome/Xfce startup.
It doesn't take long. A day at most. I've had this system up and running for months, and this just started happening. I did install some X development libraries (x11proto-core-dev, libmotif-dev, x11proto-print-dev, and x11proto-xext-dev plus their dependencies) about two weeks ago, but this problem has not been happening that long. I've installed other packages, but nothing that would seem to have any relation to this problem. I've logged out and in, rebooted, and changed from Gnome to Xfce, and none of the changes helped.
I have done nothing with the system, but starting this morning, i experienced a strange condition on my desktop. I'm unable to open any applications at all. It will close instantly.
When i tried to run from terminal, it will give me an error like this:
Quote:
I checked using
Code:
And i got around 234 which is too much that it takes almost all of the open files allowed. Logging out to text and brings back X will solve the problem, but it's only a temporary solution until X opens more sockets again. I'm running -Current (32 bit)
It seems that there's a hackish solution in here: [url]. Dunno whether it's a nice solution or not, but i'm willing to try it.
# # DO NOT EDIT THIS FILE # # It is automatically generated by /usr/sbin/grub-mkconfig using templates # from /etc/grub.d and settings from /etc/default/grub # .....
Every time update-grub run all these are put back. Editing grub.cfg does not help.
I am using ssh server to connect to my Ubuntu desktop. I opened the file sshd_config and change my port number of the server.I want to put a limit on the number of clients in the ssh server.
I with one problem to open files on terminal. By example, I open the thunar on terminal, see the error:
gustavo@universe /media/montagem $ thunar (process:7902): Gtk-WARNING **: Locale not supported by C library. Using the fallback 'C' locale. Maximum number of clients reachedThunar: Cannot open display: gustavo@universe /media/montagem $ ^C
View the entire contents of the file / etc / passwd, showing first 10 lines of file / etc / group, 10 displayed the last line of the file / etc / group. And - The total number of lines and characters in file pwd and grp
I'm trying to find a script that will return me the largest number of repeating characters. Say, I have the following line in a text file: 12345AAAAA6789AAA
I want it to return 5, because "A" is repeated 5 times in this line (more than 3 at the end).
Ever since upgrading to Fedora 14, my system has been almost unusable. I can only have a few windows of anything open before I start getting messages about:
Maximum number of clients reachedMaximum number of clients reachedMaximum number of clients reachedMaximum number of clients reachedxwininfo: unable to open display ':0.0'
I am unable to open any new windows then and lots of programs crash.
I'm attempting to search through a rather large assortment of html files created in Word using 'save as html'. what I'm trying to do is find and delete these tags (they're causing browsers to display black diamonds with white question marks):
<span style='mso-spacerun:yes'> </span> Tags contain from 1 to 4 spaces between opening and closing. I get positive results from this:
grep <span style='mso-spacerun:yes'> filename.html but once I attempt to tell it to match any number of characters up until the next '>' symbol, it tells me I'm using an invalid regex: grep <span style='mso-spacerun:yes'>[^>]+> filename.html
I've been nose-deep in regex tutorials for the past day or so, and I'm still not understanding why this doesn't work. If I put the pattern (without backslashes) into a separate file and use `grep -f patternfile filename.html`, I get no error but no matches either. So far as I can figure, the above regex boils down to: Match the string "<span style='mso-spacerun:yes'>", followed by any number of characters that are not a ">", followed by a ">". If someone could tell me where I'm going wrong with this,
I have a running proxy server that I wish to also turn into a VPN server.The VPN is not used so much that a user can access the network but is used so that they can obtain a geo specific IP address for their applications (the proxy server only does this for HTTP).I would therefore like to block off the VPN from accessing any of my Linux box's ports such as email, web server etc.Clients are given local IPs of 172.16.0.x.What should I take into consideration to block off clients from accessing dangerous stuff on the network?
Like many (most?) home users, until now I've had my regular userid in sudoers as "ALL = (ALL) ALL". It occurs to me that, even though my machine has no open ports, this is probably not a good idea - just in case my firewall suddenly burns down. So, if my thinking is right on this, I'm wondering if there is a generally approved list of Cmnd_Alias entries? At this point, I've decided to only add entries as I use them, and to try to honestly appraise my need to do the entry as sudo, vs opening a virtual console as root. My root password is non-trivial.
I have been getting the following in the samba section of the log watch report for the past few days. But don't know what it means.
[Code]....
and more. What does it mean? Does it mean any attempt to hack or is it some kind of status update? If this is not a threat and can be suppressed, how can I do this?
CentOS 5.6 Server patched to latest, multiple name-based apache virtual hosts. SELinux OFF Everything was working fine until the other day. I've been making quite a lot of changes so it may well be something I've done, but I can't find out what! Last night I got the following in my logwatch : -
Requests with error response codes 404 Not Found /admin/phpmyadmin/scripts/setup.php: 1 Time(s) /admin/pma/scripts/setup.php: 1 Time(s) /admin/scripts/setup.php: 1 Time(s) /db/scripts/setup.php: 1 Time(s) /dbadmin/scripts/setup.php: 1 Time(s) [Code]...
The problem is that NONE of my logs, secure, httpd, messages, NONE of them, show any trace of these hacking attempts. They used to show up in secure and apache error logs, but no longer.
I was just looking around and did a tail on my syslog and some strange entries came up:
[Code].....
I'm a Verizon customer in Maryland, USA running Linux at my home and I don't understand why named is looking at servers in France and Saudi Arabia. Am I just being paranoid?
I run lastb every now and again to see who is trying to p0wn my box and it dates back to november 08. how do i clear these entries to i can get a more update view? or if you know a way i can do a 'more' or something so the IP's are not flying by that would be cool too!
I've noticed on a couple of occasions that e-mail address auto-complete drop down lists have e-mail addresses in that I have never entered (!!) They all seem to be for people with the surname fenton at either gmail or hotmail. Is it likely that I have been hacked?
Anyone, I would like to ask if it was possible to change the entries of a file's inode table ?
For example
Code...
I was wondering if I can change the entries in this inode table's entries. For example I want to change the "Modify" entry ? I want it to reflect to day 2009-05-19 for example.
I've small issue with blocking local clients. I mean I've webserver that I want to allow limited number to clients to that let say I've 10 users from 10.5.1.1-10 I would like to block 1-9 and allow only last client to access that webserver . Ive tried the following
Code:
iptables -A -p tcp -i eth1 -d 10.1.1.14 -s ! 10.5.1.10 -j REJECT iptables -A INPUT -p tcp -d 10.1.1.14 -i eth1 -s ! 10.5.1.10 -j DROP
I need a little insight, and I�m not sure if the two can relate, but I am trying to find out the following. When generating WEP Keys the available bits are: 64/128/152/256; however, you need 5/13/16/29 character respectfully for each key if you generate the key manually.Can this formula be applied to passwords and the length of the password? For example: if my password had 29 characters, could I say that my password is 256-bits?