Hello,


We have received a report of brute force attempts originating from your Linode. It appears that a process internal to your Linode is attacking other servers and attempting to guess their credentials. We ask that you investigate this matter as soon as you are able. Once you have completed your investigation, kindly reply to this ticket with the answers to the following questions:


1) What was the source of the issue?
2) What steps did you take to resolve this issue?
3) What steps did you take to prevent this from occurring again?


Because of the serious nature of brute force attacks, we have applied network restrictions to your Linode to mitigate this issue. While network restrictions are in place, you can access your Linode using our out-of-band Lish console. For more information about using Lish, please take a look at the following guide:


https://www.linode.com/docs/networking/using-the-linode-shell-lish/



I think my Linode is compromised. How can I tell?

If you believe that your Linode has been compromised, you can start troubleshooting by auditing the following log files and writable directories:



/var/log/auth.log : Check this log file for signs of unauthorized access and brute-force attempts. Use the ‘last’ command to cross reference recent account logins with this file.

/tmp : This directory is often used by malicious parties to store files

Web server logs: There may be a vulnerable script or web application. The location of these log files depends on your web server (apache, nginx, etc.) configuration.

ps aux : Use this command to audit running processes for foreign processes



My Linode is compromised. What do I do now?

If you discover that your Linode is compromised, we strongly suggest that you redeploy. It is often very difficult to determine the full scope of a vulnerable system. We have a guide that can assist you with redeploying your server that you can find linked below:


https://www.linode.com/docs/security/recovering-from-a-system-compromise/


During this process, please continue to keep us updated, and let us know if you have any questions.


Kind regards,
Andrew O.


Linode Support Team

REPORT:


Hi, We have detected a network attack from an IP ( 178.79.161.246 ) from your network, a computer connected to it is probably infected and being part of a botnet. Please check it and fix it up as soon as possible. Thank you.


The IP 178.79.161.246 has just been banned by Fail2Ban after
2 attempts against apache-attack.


Domain: eliminatusvarices.com (195.78.228.250)


Here are more information about 178.79.161.246:
Lines containing IP:178.79.161.246 in /furanet/sites/*/web/htdocs/logs/access


/furanet/sites/eliminatusvarices.com/web/htdocs/logs/access:178.79.161.246 - - [22/May/2019:11:08:31 +0200] "GET /wp-login.php HTTP/1.1" 200 2369 "-" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x8664; rv:62.0) Gecko/20100101 Firefox/62.0"
/furanet/sites/eliminatusvarices.com/web/htdocs/logs/access:178.79.161.246 - - [22/May/2019:11:08:31 +0200] "POST /wp-login.php HTTP/1.1" 200 3242 "-" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x8664; rv:62.0) Gecko/20100101 Firefox/62.0"
/furanet/sites/eliminatusvarices.com/web/htdocs/logs/access:178.79.161.246 - - [22/May/2019:11:08:31 +0200] "GET /wp-login.php HTTP/1.1" 200 2369 "-" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x8664; rv:62.0) Gecko/20100101 Firefox/62.0"
/furanet/sites/eliminatusvarices.com/web/htdocs/logs/access:178.79.161.246 - - [22/May/2019:11:08:31 +0200] "POST /wp-login.php HTTP/1.1" 200 3119 "-" "-" "Mozilla/5.0 (X11; Ubuntu; Linux x8664; rv:62.0) Gecko/20100101 Firefox/62.0"


Date: Wed May 22 11:08:33 CEST 2019