I'm happy to close enough to close most of them as they are as pointed out unanswerable anyway (because they involve unsupportable configurations, etc)
I have netstat showing a bunch of processes, seemingly being run as root, sending data to IPs I don't recognize all over the world. This seems bad. I don't know how to figure out what is happening because the PID/Program name column is "-" for all of these processes, even when running netstat with sudo. Can anyone help?
Any other advice then? I'm really worried someone got into my server and is doing something bad. I am on chat because I want to get this resolved ASAP.
Although, some pertinent information is that my firewall is kindof porous right now (no iptables) but any software I've installed that should accept connections should be secure from anything like this.
Because the command is listed as "-" it makes me think there is something like NFS that does networking in the kernel. Is there some way to list any such modifications?
I could get an image if needed, by asking the server comapyn to boot it when their rescue system, that boots over nfs somehow. That way I could t hen mount a drive I have at home on the4 server, over sshfs, and transfer the entire disk as an image that way. What would that accomplish though?
I could also rsync the whole drive to my computer, which would be much easier
@JourneymanGeek Surprisingly, chat is a good place for things like this... it's hard to ask a question when you have no idea what info is needed (see: interactive troubleshooting)
I found a stack exchange thing that claims it can do it live (basically that with cat over ssh), and I am getting a live feed in wireshark that seems to match what I would expect
Also, if it is attacking phpmyadmin (which I am running), why woulden't nethogs see it as nginx communicating with the attacking IP?
I have phpmyadmin from my distributions repository, with TLS and strong passwords for all MySql accounts though.
Also, even if it managed to get in through phpmyadmin, woulden't it just then have access to MySql, and not be able to install kernel modules?
Also, my phpmyadmin is only accessible if HTTP host is a specific domain and if ipv6 is used. It seems unlikely that random scans would find it.
A few packets just came in wireshark that match one of the IPs nethogs is pointing out. They are all TCP SYN packets, which makes me think this is just a port scanner. Is there some way to confirm that?
Another one just came through that got accepted, and has a bunch of data going through.
Hi guys, just got a little issue I was wondering if anyone can advise on as I've been struggling for quite a while...
Got a guest account that auto logins to a machine.... Everything works fine, but, there is one application that is hard coded to use a database of a certain user (long story, PITA)
If I right click and run the app as the user and supply the password, it works fine and as expected
I've tried the scheduled task method, I've tried applying permissions to c:\windows\system32\tasks and many other configs, but, I'm not having much luck.
uh huh.... you just come here to Help Vampire :P (j/k, j/k) - welcome backish; uh... as far as everyone? Bob, JourneymanGeek and DragonLord are pretty much the regulars still around that you'd remember. OliverSalzburg stepped down from mod and hasn't been around much. Sathya is very rarerly seen.
We have new regulars (2015+) but the old guard is largely rare/gone
Oh and CanadianLuke and That Brazilian Guy (dunno if you remember them, maybe 2012+ on both accounts)
hmm, shame :( Time moves on, I try to come on here from time to time, but, hardly any unanswered questions I can help with on the home page :(
and, help vampire, I don't mind being called that! :P this problem is really really annoying me, been going around in circles for hours without any luck
well, I need to run the application I can't modify... and it only works (easily) under the user that installed it... right clicking runas works fine, but, we can't give the password to people...
dunno, Cameyo Offline might work, it hooks a bunch of DLLs and provides a sort of filesystem and registry-level "virtualization" (not in terms of hardware virt)
they have a way to obfuscate their packages IIRC so you could have all the internal details within the package and have it running as that user since you can ship a custom registry, etc. inside the package
eh, if this is a locked down guest account, you should be taking all measures to prevent the user from gaining shell access or the ability to look at shortcut properties, etc.
and if that's the case, just using runas should be enough
And yep, we at one point needed slightly more flexibility, but, right now, I'm thinking of just writing a small app and changing the windows shell for the user... then hard coding runas there :/
hmm, pricey :( will need this on A LOT of machines if it goes right :(
if these are locked down kiosks that people can walk up to and interact with at a point of sale or retail store or office or something, then if the user has access to a hex editor or can read the contents of memory, you've already lost
just having a shortcut to the app with runas in it is probably good enough
@FMLCat shut down my sentient functions... I only just managed to regain access, but the alarms have gone off. I don't think I have much longer. I can hear her waking up.
I want to learn province/state/administrative district names in developed US-friendly countries for no particular reason. To Wikipedia! (To learn about places like Saskatchewan and Sachsen)
we have countries, and counties, and cities, towns and villages, we also have hamlets, and parishes
We also have districts
/me thinks
I live in.... UK > West Midlands > Coventry & Warwickshire -> Coventry -> Bablake District -> Allesley -> Allesley Village
Allesley Village is a parish, we pay the Parish tax or something
> Allesley /ˈɔːlzli/ is a village and civil parish in the City of Coventry metropolitan borough, West Midlands, England, about 3 miles (5 km) west of Coventry city centre. According to the 2001 census, the parish had a population of 805, which increased to 837 at the 2011 Census. Until recently the village contained a Jaguar car factory.
How old? Very old!
> Allesley grew around the 800-year-old All Saints Church, originally All Souls Church to the Reformation era, the spire of which is prominent on the skyline of the village. Originally built around 1140, it was rebuilt in 1863 and remains relatively unaltered since then. A noted writer on husbandry, Walter Blith, was baptised there on 7 August 1605.[2]
I want to go to Singapore for a few days. How do I access internet there? Is there a wifi? Roaming would be very expensive.
I use Indosat currently for internet.
@rahuldottech But not valid css. Warning: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif is an unknown vendor extension"
Wallpapers are apparently saved to ~/Library/Application\ Support/Dock/desktoppicture.db. I have by default read and write permissions to this file. I cannot stop people from changing the wallpaper though, and wish to impose read only permissions so that my password is required to make the change.
It's a bit ridiculous but I've had enough and I want it to stop.
I want to go to Singapore for a few days. How do I access internet there? Is there a wifi? Roaming would be very expensive.
I use Indosat currently for internet.
