서버호스팅중인 DB서버가 해킹당했습니다... --;;
<pre>
[root@server xxxxx]# ls -al
total 7936
drwx------ 2 mysql mysql 4096 Jul 3 20:56 .
drwx------ 6 mysql mysql 4096 Jul 6 11:03 ..
-rw-rw---- 1 mysql mysql 9070 Jun 28 13:13 bookorder.frm
-rw-rw---- 1 mysql mysql 2064 Jul 4 10:48 bookorder.MYD
-rw-rw---- 1 mysql mysql 2048 Jul 4 10:48 bookorder.MYI
-rw-rw---- 1 mysql mysql 8730 Jun 28 13:14 codemast.frm
-rw-rw---- 1 mysql mysql 104736 Jun 28 13:14 codemast.MYD
-rw-rw---- 1 mysql mysql 32768 Jun 28 13:14 codemast.MYI
-rw-rw---- 1 mysql mysql 8742 Jun 28 13:16 examinfo.frm
-rw-rw---- 1 mysql mysql 378596 Jul 4 17:04 examinfo.MYD
-rw-rw---- 1 mysql mysql 308224 Jul 4 17:04 examinfo.MYI
-rw-rw---- 1 mysql mysql 8968 Jun 28 13:16 exampass.frm
-rw-rw---- 1 mysql mysql 113328 Jul 4 16:23 exampass.MYD
-rw-rw---- 1 mysql mysql 36864 Jul 4 16:24 exampass.MYI
-rw-rw---- 1 mysql mysql 8690 Jun 28 13:12 exams_info.frm
-rw-rw---- 1 mysql mysql 2400 Jun 28 13:12 exams_info.MYD
-rw-rw---- 1 mysql mysql 3072 Jun 28 13:12 exams_info.MYI
-rw-rw---- 1 mysql mysql 8742 Jun 24 21:35 info_bk.frm
-rw-rw---- 1 mysql mysql 240724 Jun 24 21:36 info_bk.MYD
-rw-rw---- 1 mysql mysql 287744 Jun 24 21:36 info_bk.MYI
-rw-rw---- 1 mysql mysql 8878 Jun 28 13:12 inspector.frm
-rw-rw---- 1 mysql mysql 70704 Jul 4 10:35 inspector.MYD
-rw-rw---- 1 mysql mysql 47104 Jul 4 10:35 inspector.MYI
-rw-rw---- 1 mysql mysql 8832 Jun 28 13:11 jmember.frm
-rw-rw---- 1 mysql mysql 51104 Jul 4 17:22 jmember.MYD
-rw-rw---- 1 mysql mysql 16384 Jul 4 17:22 jmember.MYI
-rw-rw---- 1 mysql mysql 8830 Jun 28 13:11 license_info.frm
-rw-rw---- 1 mysql mysql 24010 Jul 4 17:27 license_info.MYD
-rw-rw---- 1 mysql mysql 37888 Jul 4 17:27 license_info.MYI
-rw-rw---- 1 mysql mysql 8938 Jun 28 13:11 receipts.frm
-rw-rw---- 1 mysql mysql 649740 Jul 4 10:34 receipts.MYD
-rw-rw---- 1 mysql mysql 627712 Jul 4 10:34 receipts.MYI
-rw-rw---- 1 mysql mysql 9132 Jun 28 13:10 receives.frm
-rw-rw---- 1 mysql mysql 1455984 Jul 4 10:34 receives.MYD
-rw-rw---- 1 mysql mysql 570368 Jul 4 10:34 receives.MYI
-rw-rw---- 1 mysql mysql 8746 Jun 28 13:10 results.frm
-rw-rw---- 1 mysql mysql 287504 Jul 4 10:25 results.MYD
-rw-rw---- 1 mysql mysql 368640 Jul 4 10:25 results.MYI
-rw-rw---- 1 mysql mysql 8682 Jun 28 13:10 zipcode.frm
-rw-rw---- 1 mysql mysql 1858140 Jun 28 13:10 zipcode.MYD
-rw-rw---- 1 mysql mysql 268288 Jun 28 13:10 zipcode.MYI
</pre>
오늘이 6일이죠? 해킹당했다고 말하는 이유는 접속로그를 보니 4일 17시이후부터 6일 10시
까지의 로그정보가 깡그리 지워졌기 때문이죠. --;; 참고로 웹호스팅이 아니라 서버호스팅
이랍니다. 혹시 해킹이 아닐 수도 있나요? 그런데... 이상한 것은 왜 DB파일들이 모두 4일자
데이터로 되어있냐는 것이죠. 실제로 DB상의 4일 17시 이후의 데이터가 모두 없다는 것이죠
. DB서버로 접속이 불가능하여 호스팅업체에 연락을 취했을 때가 6일 10시경이었습니다. 한
마디로 4일 17시부터 서버를 리부팅한 시점(6일 10시)까지의 데이터는 모두 날아갔다고 보시
면 됩니다. 이런 경우는 어떻게 해석해야하는지요? 리부팅했을때 문제가 발생한 것일까요
? ul 4 11:59:54 localhost proftpd[17630]: localhost.localdomain (211.62.227.165[211.62.227.165]) - FTP session opened
. Jul 4 11:59:54 localhost proftpd[17630]: localhost.localdomain (211.62.227.165[211.62.227.165]) - FTP session closed
. Jul 4 15:57:50 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - FTP session opened. Jul
4 15:57:53 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - ftp: Directory ~ftp/ is not a
ccessible. Jul 4 15:57:56 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - FTP session clo
sed. Jul 4 17:32:41 localhost kernel: scsi : aborting command due to timeout : pid 0, scsi0, channel 0, id 0, lun 0 Wr
ite (10) 00 01 b5 e5 a8 00 00 10 00 Jul 4 17:32:42 localhost kernel: SCSI host 0 abort (pid 0) timed out - resetting J
ul 4 17:32:42 localhost kernel: SCSI bus is being reset for host 0 channel 0. Jul 4 17:32:44 localhost kernel: (scsi
0:0:0:0) Synchronous at 80.0 Mbyte/sec, offset 63. Jul 6 10:23:50 localhost syslogd 1.4-0: restart. Jul 6 10:23:50 l
ocalhost syslog: syslogd startup succeeded Jul 6 10:23:50 localhost kernel: klogd 1.4-0, log source = /proc/kmsg start
ed. Jul 6 10:23:50 localhost kernel: Inspecting /boot/System.map-2.4.9-34smp Jul 6 10:23:50 localhost syslog: klogd
startup succeeded Jul 6 10:23:50 localhost keytable: Loading keymap: Jul 6 10:23:50 localhost keytable:
Jul 6 10:23:50 localhost keytable: Loading system font:
Jul 6 10:23:50 localhost keytable:
Jul 6 10:23:50 localhost rc: Starting keytable: succeeded
Jul 6 10:23:50 localhost kernel: Loaded 15872 symbols from /boot/System.map-2.4.9-34smp.
Jul 6 10:23:50 localhost kernel: Symbols match kernel version 2.4.9.
Jul 6 10:23:50 localhost kernel: Loaded 168 symbols from 4 modules.
Jul 6 10:23:50 localhost kernel: Linux version 2.4.9-34smp (bhcompile at daffy.perf.redhat.com) (gcc version 2.96 2000073
1 (Red Hat Linux 7.2 2.96-108.1)) #1 SMP Sat Jun 1 06:15:25 EDT 2002 Jul 6 10:23:50 localhost kernel: BIOS-provided ph
ysical RAM map: Jul 6 10:23:50 localhost kernel: BIOS-e820: 0000000000000000 - 000000000009dc00 (usable)
Jul 6 10:23:50 localhost kernel: BIOS-e820: 000000000009dc00 - 00000000000a0000 (reserved)
Jul 6 10:23:50 localhost kernel: BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved)
Jul 6 10:23:50 localhost kernel: BIOS-e820: 0000000000100000 - 000000001ffec340 (usable)
Jul 6 10:23:50 localhost random: Initializing random number generator: succeeded
Jul 6 10:23:50 localhost kernel: BIOS-e820: 000000001ffec340 - 000000001fff0000 (ACPI data)
Jul 6 10:23:51 localhost kernel: BIOS-e820: 000000001fff0000 - 0000000020000000 (reserved)
Jul 6 10:23:51 localhost kernel: BIOS-e820: 00000000fec00000 - 0000000100000000 (reserved)
Jul 6 10:23:51 localhost kernel: Scanning bios EBDA for MXT signatur
.....
ul 6 10:23:23 localhost rc.sysinit: Loading default keymap succeeded
Jul 6 10:23:53 localhost kernel: Intel machine check architecture supported.
Jul 6 10:23:23 localhost rc.sysinit: Setting default font (lat0-sun16): succeeded
Jul 6 10:23:53 localhost kernel: Intel machine check reporting enabled on CPU#0.
Jul 6 10:23:53 localhost kernel: Enabling fast FPU save and restore... done.
Jul 6 10:23:53 localhost kernel: Enabling unmasked SIMD FPU exception support... done.
Jul 6 10:23:23 localhost rc.sysinit: Activating swap partitions: succeeded
Jul 6 10:23:23 localhost rc.sysinit: Setting hostname server: succeeded
Jul 6 10:23:23 localhost fsck: / was not cleanly unmounted, check forced.
Jul 6 10:23:53 localhost kernel: Checking 'hlt' instruction... OK.
Jul 6 10:23:53 localhost kernel: POSIX conformance testing by UNIFIX
Jul 6 10:23:53 localhost kernel: IBM machine detected. Enabling interrupts during APM calls.
Jul 6 10:23:53 localhost kernel: mtrr: v1.40 (20010327) Richard Gooch (rgooch at atnf.csiro.au)
Jul 6 10:23:53 localhost kernel: mtrr: detected mtrr type: Intel
Jul 6 10:23:23 localhost fsck: Inode
Jul 6 10:23:23 localhost fsck: 342245, i_blocks is 464, should be 448. FIXED.
Jul 6 10:23:53 localhost kernel: CPU: L1 I cache: 16K, L1 D cache: 16K
Jul 6 10:23:54 localhost kernel: CPU: L2 cache: 256K
Jul 6 10:23:23 localhost fsck: /: Inode 342244, i_blocks is 336, should be 320. FIXED.
Jul 6 10:23:54 localhost kernel: Intel machine check reporting enabled on CPU#0.
Jul 6 10:23:23 localhost fsck: Inode 961403, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:23 localhost fsck: /: Inode 961406, i_blocks is 64, should be 24. FIXED.
Jul 6 10:23:23 localhost fsck: /: Inode 961408, i_blocks is 72, should be 16. FIXED.
Jul 6 10:23:54 localhost kernel: CPU0: Intel Pentium III (Coppermine) stepping 06
Jul 6 10:23:23 localhost fsck: /: Inode 961412, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:54 localhost kernel: per-CPU timeslice cutoff: 731.68 usecs.
Jul 6 10:23:23 localhost fsck: /: Inode 961415, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:54 localhost kernel: enabled ExtINT on CPU#0
Jul 6 10:23:54 localhost kernel: ESR value before enabling vector: 00000000
Jul 6 10:23:23 localhost fsck: /: Inode 961418, i_blocks is 64, should be 16. FIXED.
Jul 6 10:23:54 localhost kernel: ESR value after enabling vector: 00000000
Jul 6 10:23:54 localhost kernel: Booting processor 1/0 eip 2000
Jul 6 10:23:23 localhost fsck: /: Inode 961421, i_blocks is 64, should be 16. FIXED.
Jul 6 10:23:54 localhost kernel: Initializing CPU#1
Jul 6 10:23:23 localhost fsck: /: Inode 961433, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:23 localhost fsck: /: Inode 961436, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:23 localhost fsck: /: Inode 961445, i_blocks is 64, should be 32. FIXED.
Jul 6 10:23:54 localhost kernel: masked ExtINT on CPU#1
Jul 6 10:23:23 localhost fsck: /: Inode 961447, i_blocks is 72, should be 24. FIXED.
Jul 6 10:23:54 localhost kernel: ESR value before enabling vector: 00000000
Jul 6 10:23:23 localhost fsck: /: Inode 961451, i_blocks is 64, should be 8. FIXED.
Jul 6 10:23:54 localhost xinetd[617]: chargen disabled, removing
Jul 6 10:23:54 localhost kernel: ESR value after enabling vector: 00000000
Jul 6 10:23:54 localhost kernel: Calibrating delay loop... 1992.29 BogoMIPS
Jul 6 10:23:54 localhost xinetd[617]: chargen disabled, removing
Jul 6 10:23:23 localhost fsck: /: Inode 961409, i_blocks is 448, should be
Jul 6 10:23:55 localhost xinetd[617]: daytime disabled, removing
Jul 6 10:23:55 localhost kernel: CPU: L1 I cache: 16K, L1 D cache: 16K
Jul 6 10:23:55 localhost kernel: CPU: L2 cache: 256K
Jul 6 10:23:55 localhost xinetd[617]: daytime disabled, removing
Jul 6 10:23:55 localhost kernel: Intel machine check reporting enabled on CPU#1.
....
message파일중 일부입니다... 보시면 아시겠지만 4일 17시이후부터 셧다운시점 6일 10시사이
의 정보가 없습니다. 도대체 무슨 일일까요? 더 필요한 부분이 있으면 알려주십시오.
--
'와니와 준하'와는 전혀 무관한 와니