ynot
Junior Member
- Apr 25, 2020
- 106
- 122
Hey guys,
I have a really nasty problem with some of my VPS's.
I am not a server admin and couldn't find a solution by myself, so will appreciate any answers.
My VPS configuration:
The problem - there is a Malware inside the PHP package which runs after some time. It's mining Bitcoins and respectively draining 100% of my CPU which causes the servers to crash.
At the beginning I did not have a password for Redis. I didn't believe it's necessary since the Redis port was closed. Right now I did set a password.
The malware appears in the PHP container and generates files:
I clean it with following commands:
The problem is that periodically those files are replaced with those of the malware with rights of user www-data.
Right now my only temporarily solution is to clean those files via Cron every minute.
A really nasty problem, all comments will be appreciated
I have a really nasty problem with some of my VPS's.
I am not a server admin and couldn't find a solution by myself, so will appreciate any answers.
My VPS configuration:
- Docker containers - PHP-FPM, Redis, MariaDB, Adminer, SFTP + Mailserver
- I have Apache installed directly over the servers and the traffic is routed via Proxy to the PHP container.
- I have installed a Firewall, but so far I couldn't manage to configure it to work correctly with Docker.
- SSH access is limited only with pair of keys, root login is forbidden. I only work with sudo inside.
The problem - there is a Malware inside the PHP package which runs after some time. It's mining Bitcoins and respectively draining 100% of my CPU which causes the servers to crash.
At the beginning I did not have a password for Redis. I didn't believe it's necessary since the Redis port was closed. Right now I did set a password.
The malware appears in the PHP container and generates files:
Code:
/tmp/kdevtmpfsi
/var/tmp/kinsing
/tmp/zzz
/tmp/zzz.shI clean it with following commands:
Code:
kill -9 $(pidof kdevtmpfsi)
kill -9 $(pidof kinsing)
rm -f /tmp/kdevtmpfsi ; echo "ALL_GOOD_HERE" > /tmp/kdevtmpfsi
rm -f /var/tmp/kinsing ; echo "ALL_GOOD_HERE" > /var/tmp/kinsing
rm -f /tmp/zzz ; echo "ALL_GOOD_HERE" > /tmp/zzz
rm -f /tmp/zzz.sh ; echo "ALL_GOOD_HERE" > /tmp/zzz.sh
chmod -R go-x /tmp
chmod -R 0777 /tmp/
chmod -R go-x /var/tmp
chmod -R 0777 /var/tmp/The problem is that periodically those files are replaced with those of the malware with rights of user www-data.
Right now my only temporarily solution is to clean those files via Cron every minute.
A really nasty problem, all comments will be appreciated
