Olá alugamos um servidor virtual de 1and1 CentOS 6 com o Parallels Plesk Panel 12 (64 bits)
eles o colocaram em modo de recuperação, já que "foi descoberto que faz parte de uma rede de máquinas comprometidas que lideram um ataque de negação de serviço (DoS-Attack) contra outros servidores". Nós não podemos acessar o servidor normalmente até que seja corrigido.
Atualmente tenho acesso via modo de recuperação. O diretório raiz do VServer é montado em / mnt
Eles gentilmente enviaram esse lixo:
- Details about the malicious processes:
List of malicious processes:===============================
79405009 root 63721 0.3 0.0 114580 33932 ? D May01 00:06:01 sendmail: ./u3S78V7U009014 from queue
79405009 root 43601 0.4 0.0 114536 33804 ? D May01 00:06:01 sendmail: ./u3S7GSjD009908 from queue
79405009 root 52161 0.3 0.0 114548 33952 ? D May01 00:05:42 sendmail: ./u3SEPxEx031537 mx4.hotmail.com.: client MAIL
79405009 root 12349 0.3 0.0 114248 33612 ? S May01 00:05:31 sendmail: ./u3SKWist013960 beer.com.: user open
79405009 root 35948 0.3 0.0 114868 34028 ? S May01 00:05:13 sendmail: ./u3SMgtPj030769 gogo.mn.: user open
79405009 root 59426 0.3 0.0 114908 34172 ? D May01 00:04:40 sendmail: ./u3TASPHs002157 mx1.hotmail.com.: client MAIL
79405009 root 61306 0.3 0.0 114664 33868 ? S May01 00:04:39 sendmail: ./u3T8f62p019985 mx1.breakthru.com.: user open
79405009 root 1611 0.3 0.0 114440 33792 ? S May01 00:03:47 sendmail: ./u3TMkZM2028370 mx1.hotmail.com.: client greeting
79405009 root 6664 0.3 0.0 114560 33868 ? D May01 00:04:09 sendmail: ./u3TLL0t2018878 from queue
79405009 root 2345 0.2 0.0 114864 34176 ? S May01 00:02:56 sendmail: ./u3UDLWT0010488 mta7.am0.yahoodns.net.: client MAIL
79405009 root 5262 0.3 0.0 114960 34288 ? S May01 00:03:44 sendmail: ./u3U4HRpn003520 mail2.siteamerica.com.: user open
79405009 root 19138 0.3 0.0 115508 34780 ? S May01 00:03:15 sendmail: ./u3UC3QYX002579 mx2.hotmail.com.: client EHLO
79405009 root 34044 0.3 0.0 115072 34292 ? D May01 00:03:09 sendmail: ./u3UDdBA5012117 from queue
79405009 root 39121 0.3 0.0 114992 34272 ? D 00:43 00:02:57 sendmail: ./u3UG0NMv026076 from queue
79405009 root 34198 0.3 0.0 115188 34400 ? D 01:43 00:02:49 sendmail: ./u3UKxATO003157 mta6.am0.yahoodns.net.: client MAIL
79405009 root 25110 0.3 0.0 115236 34460 ? S 02:43 00:02:29 sendmail: ./u3UM7mJk010596 mx3.hotmail.com.: client MAIL
79405009 root 34060 0.3 0.0 115516 34712 ? D 03:43 00:02:20 sendmail: ./u410hmIn031536 from queue
79405009 root 24722 0.3 0.0 116004 35280 ? R 04:43 00:02:05 sendmail: ./u416lHtr015928 mx1.hotmail.com.: user open
79405009 root 765 0.3 0.0 115828 34984 ? D 05:43 00:01:49 sendmail: ./u41AJE2I012024 mx4.hotmail.com.: client MAIL
79405009 root 26444 0.3 0.0 115724 34928 ? D 06:43 00:01:35 sendmail: ./u41HYq5G003987 from queue
79405009 root 12117 0.3 0.0 115552 34884 ? D 07:43 00:01:20 sendmail: ./u41HkH7U005386 mta7.am0.yahoodns.net.: client MAIL
79405009 root 44179 0.3 0.0 114976 34212 ? S 08:43 00:01:09 sendmail: ./u41LioD9004030 mta5.am0.yahoodns.net.: client EHLO
root@hn1512:~$ find /vz/root/79405009/var/spool/mqueue|wc -l
533259
PROCESSES:
==================
CTID USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
79405009 root 36122 0.0 0.0 19236 1120 ? Ss Apr23 00:00:26 init
79405009 root 36139 0.0 0.0 0 0 ? S Apr23 00:00:00 [kthreadd/794050]
79405009 root 36140 0.0 0.0 0 0 ? S Apr23 00:00:00 [khelper/7940500]
79405009 root 38593 0.0 0.0 10644 352 ? S<s Apr23 00:00:00 /sbin/udevd -d
79405009 root 40741 0.0 0.0 345728 13700 ? Ss Apr23 00:00:19 /usr/bin/sw-engine -c /usr/local/psa/admin/conf/php.ini /usr/local/psa/admin/bin/modules/watchdog/wdcollect -c /usr/local/psa/etc/modules/watchdog/wdcollect.inc.php
79405009 root 41870 0.7 0.0 184328 5560 ? Sl Apr23 01:33:17 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
79405009 dbus 42170 0.0 0.0 21436 368 ? Ss Apr23 00:00:00 dbus-daemon --system
79405009 root 42259 0.0 0.0 66228 580 ? Ss Apr23 00:00:12 /usr/sbin/sshd
79405009 root 42367 0.0 0.0 66412 284 ? Ss Apr23 00:00:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
79405009 root 42369 0.0 0.0 66412 32 ? S Apr23 00:00:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
79405009 root 42659 0.0 0.0 82644 1672 ? Ss Apr23 00:04:13 sendmail: accepting connections
79405009 smmsp 42792 0.0 0.0 78236 1592 ? Ss Apr23 00:00:00 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
79405009 root 43545 0.0 0.0 332044 25092 ? Ss Apr23 00:00:21 /usr/sbin/httpd
79405009 root 44966 0.0 0.0 11308 788 ? S Apr23 00:00:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock --pid-file=/var/run/mysqld/mysqld.pid --basedir=/usr --user=mysql
79405009 mysql 45316 0.0 0.0 1023024 37528 ? Sl Apr23 00:06:18 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
79405009 root 48599 0.0 0.0 116864 900 ? Ss Apr23 00:00:18 crond
79405009 root 48608 0.0 0.0 195696 2732 ? Ssl Apr23 00:00:49 /usr/local/psa/admin/bin/modules/watchdog/monit -Ic /usr/local/psa/etc/modules/watchdog/monitrc
79405009 root 41790 0.0 0.0 44964 1424 ? Ss Apr25 00:00:00 sw-cp-server: master process /usr/sbin/sw-cp-serverd -c /etc/sw-cp-server/config
79405009 497 41797 0.0 0.0 45420 3044 ? S Apr25 00:00:00 sw-cp-server: worker process
79405009 root 43406 0.0 0.0 21720 992 ? Ss Apr29 00:00:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
79405009 root 14301 0.0 0.0 350868 9064 ? Ss Apr29 00:00:00 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf)
79405009 root 41948 0.3 0.0 114792 33992 ? S May01 00:07:06 sendmail: ./u3RGw45P031441 mail.gnail.com.: user open
79405009 root 12946 0.4 0.0 114816 33984 ? S May01 00:07:00 sendmail: ./u3RJ6P1J015717 mx2.hotmail.com.: user open
79405009 root 61532 0.3 0.0 114728 33948 ? D May01 00:06:43 sendmail: ./u3RNPKLg014912 mta7.am0.yahoodns.net.: client MAIL
79405009 root 3692 0.3 0.0 114652 33960 ? S May01 00:05:52 sendmail: ./u3SB27wO005821 mta7.am0.yahoodns.net.: client MAIL
79405009 apache 32306 0.0 0.0 237004 13856 ? S May01 00:00:05 /usr/sbin/httpd
79405009 root 63721 0.3 0.0 114580 33932 ? D May01 00:06:02 sendmail: ./u3S6NC3T004736 from queue
79405009 root 43601 0.4 0.0 114536 33804 ? S May01 00:06:01 sendmail: ./u3S7EHWh009648 mx3.hotmail.com.: user open
79405009 root 52161 0.3 0.0 114548 33952 ? S May01 00:05:43 sendmail: ./u3SDB6Fb021778 mx.sprintpcs.com.: user open
79405009 root 12349 0.3 0.0 114248 33612 ? S May01 00:05:31 sendmail: ./u3SKWist013960 beer.com.: user open
79405009 root 35948 0.3 0.0 114868 34028 ? S May01 00:05:13 sendmail: ./u3T0rKpL013515 mx2.hotmail.com.: client MAIL
79405009 root 59426 0.3 0.0 114908 34172 ? S May01 00:04:40 sendmail: ./u3T9Kos9026795 sashi.com.: user open
79405009 root 61306 0.3 0.0 114664 33868 ? S May01 00:04:39 sendmail: ./u3T8f62p019985 mx1.breakthru.com.: user open
79405009 root 1611 0.3 0.0 114440 33792 ? S May01 00:03:47 sendmail: ./u3TMkSi7028322 mx3.hotmail.com.: client MAIL
79405009 root 6664 0.3 0.0 114560 33868 ? S May01 00:04:09 sendmail: ./u3U11HcB013813 mta7.am0.yahoodns.net.: client EHLO
79405009 root 2345 0.2 0.0 114864 34176 ? D May01 00:02:56 sendmail: ./u3UDVu1p011442 mta7.am0.yahoodns.net.: client MAIL
79405009 root 5262 0.3 0.0 114960 34288 ? S May01 00:03:44 sendmail: ./u3U4HRpn003520 mail2.siteamerica.com.: user open
79405009 root 19138 0.3 0.0 115508 34780 ? S May01 00:03:15 sendmail: ./u3U9wUr3019601 mta6.am0.yahoodns.net.: user open
79405009 root 34044 0.3 0.0 115072 34292 ? D May01 00:03:09 sendmail: ./u3UDrYjn013660 mta6.am0.yahoodns.net.: client MAIL
79405009 root 39121 0.3 0.0 114992 34272 ? D 00:43 00:02:57 sendmail: ./u3UEDHB1015373 from queue
79405009 root 34198 0.3 0.0 115188 34400 ? D 01:43 00:02:50 sendmail: ./u3UKZf2a000339 mta6.am0.yahoodns.net.: client MAIL
79405009 root 25110 0.3 0.0 115236 34460 ? S 02:43 00:02:29 sendmail: ./u3UM5MjA010297 mx3.hotmail.com.: user open
79405009 root 34060 0.3 0.0 115516 34712 ? D 03:43 00:02:20 sendmail: ./u410hmJN031536 from queue
79405009 root 24722 0.3 0.0 116000 35276 ? D 04:43 00:02:05 sendmail: ./u419etov007939 mx1.hotmail.com.: client MAIL
79405009 root 765 0.3 0.0 115828 34984 ? S 05:43 00:01:49 sendmail: ./u419pFGH009313 mx2.hotmail.com.: user open
79405009 root 26444 0.3 0.0 115724 34928 ? D 06:43 00:01:36 sendmail: ./u41GsI4I000523 from queue
79405009 root 12117 0.3 0.0 115552 34884 ? S 07:43 00:01:20 sendmail: ./u41I2Lg0007106 mx4.hotmail.com.: client greeting
79405009 root 44179 0.3 0.0 114976 34212 ? S 08:43 00:01:09 sendmail: ./u41NRUWX019486 mta7.am0.yahoodns.net.: client MAIL
79405009 apache 64470 0.0 0.0 332308 17988 ? S 09:43 00:00:00 /usr/sbin/httpd
79405009 root 1739 0.4 0.0 115232 34568 ? S 09:43 00:01:01 sendmail: ./u421eQ0C001701 mta7.am0.yahoodns.net.: client EHLO
79405009 root 35706 0.5 0.0 115084 34340 ? S 10:43 00:00:56 sendmail: ./u422RGJx007171 mx4.hotmail.com.: client EHLO
79405009 root 22405 0.5 0.0 115384 34576 ? S 11:43 00:00:44 sendmail: ./u423w4fh018233 mta7.am0.yahoodns.net.: client greeting
79405009 apache 36495 0.0 0.0 332716 18412 ? S 12:00 00:00:00 /usr/sbin/httpd
79405009 apache 36616 0.0 0.0 332176 17636 ? S 12:00 00:00:00 /usr/sbin/httpd
79405009 apache 2911 0.0 0.0 332328 17976 ? S 12:34 00:00:00 /usr/sbin/httpd
79405009 apache 11548 0.0 0.0 332324 17676 ? S 12:36 00:00:00 /usr/sbin/httpd
79405009 root 41863 0.6 0.0 115296 34540 ? S 12:43 00:00:24 sendmail: ./u428k2sq021102 mx4.hotmail.com.: client MAIL
79405009 root 22811 4.5 0.0 114660 34020 ? D 13:43 00:00:11 sendmail: ./u42B8Ktp009491 from queue
79405009 smmsp 22820 0.0 0.0 78332 2476 ? S 13:43 00:00:00 sendmail: ./u3RKKEoo023232 from queue
79405009 root 23250 0.0 0.0 82812 3336 ? S 13:43 00:00:00 sendmail: server localhost [127.0.0.1] cmd re
Parece que o sendmail é a causa do problema.
Estamos dispensando este servidor que precisamos apenas para obter um mysqldump de 2 bancos de dados em dados do mysql (que não podemos acessar no modo de recuperação)
Idealmente, se possível, eu gostaria de remover o sendmail da caixa e, presumivelmente, como o sendmail não existe mais, eles podem colocar a caixa novamente online para que eu possa entrar no phpmyadmin e despejar os bancos de dados que eu preciso.
Como posso remover o sendmail do modo de recuperação? ou há algo mais que eu poderia tentar?