RimuHosting Blog

Category: Security

  • DNS amplification DoS attacks

    If you are running a DNS server, then you need to check it is not being co-opted into ‘DNS amplification attacks’. Random nasty servers (typically part of virus created bot-nets) send your DNS server a short request but use a fake source IP address.  Your DNS server then sends a (typically) long reply back to…

  • Finding Exploits and Trojan php hacks on a website

    Its always unfortunate when you are exploited, and the best method to fix a site is to wipe and restore from a known backup as well as track down the entry point they gained access and fix it. Sometimes you need to ‘clean’ a site of these files before migrating things over however , or…

  • Blocking malicious crawlers or scrapers in Apache

    Occasionally we see a customer who has a popular website that often gets people trying to crawl it and copy the lot, This has the unfortunate side effect that its hammering the site. Made worse only by dynamic pages and loops this can literally take down a server in some occasions. Often you can slow…

  • Finding spam sending PHP scripts on your server

    Everyone has the occasional user who may leave something on their server that may send spam, or not update things as fast as they should. Tracking down the spammer can be a real problem though. Sometimes you can track down the domain, but not the script, other times they may have so many files that…

  • Account authorization and password resets

    The primary way we identify our customers is via the email addresses associated with your account. If you do not communicate with us using one of these listed accounts, it may delay or slow the work we do on your server until we can verify you are authorized to request work done on the server.…

  • Plesk updates and server security

    Recently we were advised of a significant vulnerability in all older versions of the Plesk Panel. If you have not done so recently, we strongly recommend you schedule some time to update. Extended details about that are available. You can follow their instructions to update your Plesk instance.  Or please just pop in a support…

  • Linux kernel CVE-2012-0056 vulnerability

    You have probably all heard about the recent local privilige escalation in recent Linux kernels by now. If not you can read all about it here. This only affects our recent Ubuntu 11.10 “Oneiric” VPSs, which by default were installed with a Linux 3.0.4 kernel. The 3.0.4 kernel was also tested to work with some…

  • Checking a potentially hacked machine and reinstalling packages when you break things

    Sometimes you may see something odd go past in the logs, on the screen, or something might just seem a bit ‘off’ somehow. Its a good idea when this happens to just double check that things are as they should be, verify packages, binaries, check logs etc Here are a few things i find helpful…

  • DigiNotar and SSL certificates

    Great news! We were pretty sure, but a recent notification from our certificate supplier told us that none of the certificates ordered on behalf of our customers are signed by DigiNotar. For those of you not aware, DigiNotar is a Certificate Authority who provided signed SSL Certificates against their own trust chain. Which was recognized…

  • Why is your server sending spam? why does it keep crashing with high load?

    We get asked these questions regularly, and 9 out of 10 times it may be because your server may have been hacked, either on a user level, web application, or more. Here are some ways to quickly check for the most common things we see , and some of the processes we go through to…