Chia Sẽ Kinh Nghiệm Về IT



Tìm Kiếm Với Google
-


Gởi Ðề Tài Mới  Gửi trả lời
 
Công Cụ Xếp Bài
Tuổi 06-05-2014, 09:36 AM   #1
hoctinhoc
Guest
 
Trả Lời: n/a
Làm gì khi server của bạn bị Hacked, compromised?
Làm gì khi server của bạn bị Hacked, compromised?

Working with a hacked or compromised server


Article Contents

NOTE:
Remember that it is your responsibility to maintain the security of any scripts or applications you choose to install and use on your hosted service. For more details, please read our Statement of Support.

Overview

An exploited or hacked server is one that is no longer fully under your control. Someone else is now partially controlling your server and using it for their own purposes. Here are some common reasons to exploit a server:
  • Send out spam email.
  • Launch attacks against other servers. Thus, consuming your CPU, memory, and bandwidth resources.
  • Install a phishing website on your server to gain access to sensitive information.
Background

How can my service be exploited?

There are two primary ways a server may be compromised:
  1. The hacker has guessed a password of a user on the server. This may be a email, ftp, or ssh user.
  2. The hacker has gained access through a security hole in a web application (or its addons/plugins) such as WordPress, Joomla, Drupal, etc.
How do I know if my service has been exploited?

Many times, customers may not notice that they have been compromised until they are contacted by the (mt) Media Temple Abuse Department. However, if you follow our Advanced Guides regarding checking to see if your service has been compromised you may be able to see some of this activity yourself.
What steps can I take to prevent my service from being hacked?

Use Strong Passwords

Be sure to use strong passwords. This would include passwords for the AccountCenter, Plesk, your root password, etc. The stronger the password the better protected your service will be. GRC (Gibson Research Corporation) provides a free tool that will generate strong passwords for you.
Use Secure Protocols

When connecting to your services, it is best to use secure connections whenever possible. This would include SSL connections for email, and using SFTP instead of the more common FTP protocol. You can learn more about using secure connections for these services by reading the following guides:
Maintain Regular Backups

Be sure to backup your data on a regular basis. If a domain, or your entire service, becomes compromised, it may go un-noticed for a while. You would not want to restore a compromised backup. You always want to restore from the last known clean backup.
Harden your PHP Settings

Just making a few changes to your php.ini file can greatly increase the security of your service. Here are a few settings we recommend:
If you are not sure how to edit your php.ini file, you can use the following guides:
If you want to set these configurations differently for each domain, you will want to use a .htaccess file:
Working with third-party applications

When you are working with third-party software such as Wordpress, Drupal, Joomla please consider these points. This is also very important with applications that rely on plug-ins for extended functionality.
  • Be careful with what third-party tools you choose to use. Pick software that is known to have a reliable reputation for security. Consider using software that have frequent updates to patch security holes.
  • Be sure to update your software regularly. Subscribe to the RSS feeds of any applications you use. This is a fantastic, effortless way to stay aware of any new updates that you may need to stay secure.
I've been hacked. What can I do?

  1. Backup your domains and service, but please remember that this backup will probably contain compromised scripts. You do NOT want to restore directly from this backup.
  2. Take your website offline temporarily, or until you know you have resolved the issue. Alternatively, consider displaying an "Under Construction" page. This should be done to prevent any hacked pages from being served to your site visitors/customers.
  3. Start performing Damage Assessment. What is the scope of the problem? Is only one domain affected? Are other domains on your service affected also?
  4. Start the Recovery Process. The best thing you can do is reinstall your environment from a known clean source.
    • Grid Customers - You may need to submit a support request asking for your Grid service to be re-provisioned.
    • Update all of your passwords, and make sure they are secure. See step above.
  5. Finally, take the steps to restore your online presence.
More General Tips



Tham khảo: http://kb.mediatemple.net/questions/...ised+server#gs

  Trả lời ngay kèm theo trích dẫn này
Gửi trả lời


Công Cụ
Xếp Bài

Quyền Hạn Của Bạn
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is Mở
Hình Cảm xúc đang Mở
[IMG] đang Mở
Mã HTML đang Tắt




Bây giờ là 04:20 PM. Giờ GMT +7



Diễn đàn tin học QuantriNet
quantrinet.com | quantrimang.co.cc
Founded by Trương Văn Phương | Developed by QuantriNet's members.
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.