적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

서버호스팅중인 DB서버가 해킹당했습니다... --;;
 <pre>
[root@server xxxxx]# ls -al
total 7936
drwx------    2 mysql    mysql        4096 Jul  3 20:56 .
drwx------    6 mysql    mysql        4096 Jul  6 11:03 ..
-rw-rw----    1 mysql    mysql        9070 Jun 28 13:13 bookorder.frm
-rw-rw----    1 mysql    mysql        2064 Jul  4 10:48 bookorder.MYD
-rw-rw----    1 mysql    mysql        2048 Jul  4 10:48 bookorder.MYI
-rw-rw----    1 mysql    mysql        8730 Jun 28 13:14 codemast.frm
-rw-rw----    1 mysql    mysql      104736 Jun 28 13:14 codemast.MYD
-rw-rw----    1 mysql    mysql       32768 Jun 28 13:14 codemast.MYI
-rw-rw----    1 mysql    mysql        8742 Jun 28 13:16 examinfo.frm
-rw-rw----    1 mysql    mysql      378596 Jul  4 17:04 examinfo.MYD
-rw-rw----    1 mysql    mysql      308224 Jul  4 17:04 examinfo.MYI
-rw-rw----    1 mysql    mysql        8968 Jun 28 13:16 exampass.frm
-rw-rw----    1 mysql    mysql      113328 Jul  4 16:23 exampass.MYD
-rw-rw----    1 mysql    mysql       36864 Jul  4 16:24 exampass.MYI
-rw-rw----    1 mysql    mysql        8690 Jun 28 13:12 exams_info.frm
-rw-rw----    1 mysql    mysql        2400 Jun 28 13:12 exams_info.MYD
-rw-rw----    1 mysql    mysql        3072 Jun 28 13:12 exams_info.MYI
-rw-rw----    1 mysql    mysql        8742 Jun 24 21:35 info_bk.frm
-rw-rw----    1 mysql    mysql      240724 Jun 24 21:36 info_bk.MYD
-rw-rw----    1 mysql    mysql      287744 Jun 24 21:36 info_bk.MYI
-rw-rw----    1 mysql    mysql        8878 Jun 28 13:12 inspector.frm
-rw-rw----    1 mysql    mysql       70704 Jul  4 10:35 inspector.MYD
-rw-rw----    1 mysql    mysql       47104 Jul  4 10:35 inspector.MYI
-rw-rw----    1 mysql    mysql        8832 Jun 28 13:11 jmember.frm
-rw-rw----    1 mysql    mysql       51104 Jul  4 17:22 jmember.MYD
-rw-rw----    1 mysql    mysql       16384 Jul  4 17:22 jmember.MYI
-rw-rw----    1 mysql    mysql        8830 Jun 28 13:11 license_info.frm
-rw-rw----    1 mysql    mysql       24010 Jul  4 17:27 license_info.MYD
-rw-rw----    1 mysql    mysql       37888 Jul  4 17:27 license_info.MYI
-rw-rw----    1 mysql    mysql        8938 Jun 28 13:11 receipts.frm
-rw-rw----    1 mysql    mysql      649740 Jul  4 10:34 receipts.MYD
-rw-rw----    1 mysql    mysql      627712 Jul  4 10:34 receipts.MYI
-rw-rw----    1 mysql    mysql        9132 Jun 28 13:10 receives.frm
-rw-rw----    1 mysql    mysql     1455984 Jul  4 10:34 receives.MYD
-rw-rw----    1 mysql    mysql      570368 Jul  4 10:34 receives.MYI
-rw-rw----    1 mysql    mysql        8746 Jun 28 13:10 results.frm
-rw-rw----    1 mysql    mysql      287504 Jul  4 10:25 results.MYD
-rw-rw----    1 mysql    mysql      368640 Jul  4 10:25 results.MYI
-rw-rw----    1 mysql    mysql        8682 Jun 28 13:10 zipcode.frm
-rw-rw----    1 mysql    mysql     1858140 Jun 28 13:10 zipcode.MYD
-rw-rw----    1 mysql    mysql      268288 Jun 28 13:10 zipcode.MYI
</pre>
 오늘이 6일이죠? 해킹당했다고 말하는 이유는 접속로그를 보니 4일 17시이후부터 6일 10시까지의 로그정보가 깡그리 지워졌기 때문이죠. --;; 참고로 웹호스팅이 아니라 서버호스팅이랍니다. 혹시 해킹이 아닐 수도 있나요?
 그런데... 이상한 것은 왜 DB파일들이 모두 4일자 데이터로 되어있냐는 것이죠. 실제로 DB상의 4일 17시 이후의 데이터가 모두 없다는 것이죠. DB서버로 접속이 불가능하여 호스팅업체에 연락을 취했을 때가 6일 10시경이었습니다. 한마디로 4일 17시부터 서버를 리부팅한 시점(6일 10시)까지의 데이터는 모두 날아갔다고 보시면 됩니다. 
 이런 경우는 어떻게 해석해야하는지요? 리부팅했을때 문제가 발생한 것일까요?
 ul  4 11:59:54 localhost proftpd[17630]: localhost.localdomain (211.62.227.165[211.62.227.165]) - FTP session opened.
Jul  4 11:59:54 localhost proftpd[17630]: localhost.localdomain (211.62.227.165[211.62.227.165]) - FTP session closed.
Jul  4 15:57:50 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - FTP session opened.
Jul  4 15:57:53 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - ftp: Directory ~ftp/ is not accessible. 
Jul  4 15:57:56 localhost proftpd[23738]: localhost.localdomain (62.98.57.33[62.98.57.33]) - FTP session closed.
Jul  4 17:32:41 localhost kernel: scsi : aborting command due to timeout : pid 0, scsi0, channel 0, id 0, lun 0 Write (10) 00 01 b5 e5 a8 00 00 10 00
Jul  4 17:32:42 localhost kernel: SCSI host 0 abort (pid 0) timed out - resetting
Jul  4 17:32:42 localhost kernel: SCSI bus is being reset for host 0 channel 0.
Jul  4 17:32:44 localhost kernel: (scsi0:0:0:0) Synchronous at 80.0 Mbyte/sec, offset 63.
Jul  6 10:23:50 localhost syslogd 1.4-0: restart.
Jul  6 10:23:50 localhost syslog: syslogd startup succeeded
Jul  6 10:23:50 localhost kernel: klogd 1.4-0, log source = /proc/kmsg started.
Jul  6 10:23:50 localhost kernel: Inspecting /boot/System.map-2.4.9-34smp
Jul  6 10:23:50 localhost syslog: klogd startup succeeded
Jul  6 10:23:50 localhost keytable: Loading keymap:
Jul  6 10:23:50 localhost keytable:
Jul  6 10:23:50 localhost keytable: Loading system font:
Jul  6 10:23:50 localhost keytable:
Jul  6 10:23:50 localhost rc: Starting keytable:  succeeded
Jul  6 10:23:50 localhost kernel: Loaded 15872 symbols from /boot/System.map-2.4.9-34smp.
Jul  6 10:23:50 localhost kernel: Symbols match kernel version 2.4.9.
Jul  6 10:23:50 localhost kernel: Loaded 168 symbols from 4 modules.
Jul  6 10:23:50 localhost kernel: Linux version 2.4.9-34smp (bhcompile@daffy.perf.redhat.com) (gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-108.1)) #1 SMP Sat Jun 1 06:15:25 EDT 2002
Jul  6 10:23:50 localhost kernel: BIOS-provided physical RAM map:
Jul  6 10:23:50 localhost kernel:  BIOS-e820: 0000000000000000 - 000000000009dc00 (usable)
Jul  6 10:23:50 localhost kernel:  BIOS-e820: 000000000009dc00 - 00000000000a0000 (reserved)
Jul  6 10:23:50 localhost kernel:  BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved)
Jul  6 10:23:50 localhost kernel:  BIOS-e820: 0000000000100000 - 000000001ffec340 (usable)
Jul  6 10:23:50 localhost random: Initializing random number generator:  succeeded
Jul  6 10:23:50 localhost kernel:  BIOS-e820: 000000001ffec340 - 000000001fff0000 (ACPI data)
Jul  6 10:23:51 localhost kernel:  BIOS-e820: 000000001fff0000 - 0000000020000000 (reserved)
Jul  6 10:23:51 localhost kernel:  BIOS-e820: 00000000fec00000 - 0000000100000000 (reserved)
Jul  6 10:23:51 localhost kernel: Scanning bios EBDA for MXT signatur
.....
ul  6 10:23:23 localhost rc.sysinit: Loading default keymap succeeded
Jul  6 10:23:53 localhost kernel: Intel machine check architecture supported.
Jul  6 10:23:23 localhost rc.sysinit: Setting default font (lat0-sun16):  succeeded
Jul  6 10:23:53 localhost kernel: Intel machine check reporting enabled on CPU#0.
Jul  6 10:23:53 localhost kernel: Enabling fast FPU save and restore... done.
Jul  6 10:23:53 localhost kernel: Enabling unmasked SIMD FPU exception support... done.
Jul  6 10:23:23 localhost rc.sysinit: Activating swap partitions:  succeeded
Jul  6 10:23:23 localhost rc.sysinit: Setting hostname server:  succeeded
Jul  6 10:23:23 localhost fsck: / was not cleanly unmounted, check forced.
Jul  6 10:23:53 localhost kernel: Checking &#039;hlt&#039; instruction... OK.
Jul  6 10:23:53 localhost kernel: POSIX conformance testing by UNIFIX
Jul  6 10:23:53 localhost kernel: IBM machine detected. Enabling interrupts during APM calls.
Jul  6 10:23:53 localhost kernel: mtrr: v1.40 (20010327) Richard Gooch (rgooch@atnf.csiro.au)
Jul  6 10:23:53 localhost kernel: mtrr: detected mtrr type: Intel
Jul  6 10:23:23 localhost fsck: Inode
Jul  6 10:23:23 localhost fsck: 342245, i_blocks is 464, should be 448.  FIXED.
Jul  6 10:23:53 localhost kernel: CPU: L1 I cache: 16K, L1 D cache: 16K
Jul  6 10:23:54 localhost kernel: CPU: L2 cache: 256K
Jul  6 10:23:23 localhost fsck: /: Inode 342244, i_blocks is 336, should be 320.  FIXED.
Jul  6 10:23:54 localhost kernel: Intel machine check reporting enabled on CPU#0.
Jul  6 10:23:23 localhost fsck: Inode 961403, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:23 localhost fsck: /: Inode 961406, i_blocks is 64, should be 24.  FIXED.
Jul  6 10:23:23 localhost fsck: /: Inode 961408, i_blocks is 72, should be 16.  FIXED.
Jul  6 10:23:54 localhost kernel: CPU0: Intel Pentium III (Coppermine) stepping 06
Jul  6 10:23:23 localhost fsck: /: Inode 961412, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:54 localhost kernel: per-CPU timeslice cutoff: 731.68 usecs.
Jul  6 10:23:23 localhost fsck: /: Inode 961415, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:54 localhost kernel: enabled ExtINT on CPU#0
Jul  6 10:23:54 localhost kernel: ESR value before enabling vector: 00000000
Jul  6 10:23:23 localhost fsck: /: Inode 961418, i_blocks is 64, should be 16.  FIXED.
Jul  6 10:23:54 localhost kernel: ESR value after enabling vector: 00000000
Jul  6 10:23:54 localhost kernel: Booting processor 1/0 eip 2000
Jul  6 10:23:23 localhost fsck: /: Inode 961421, i_blocks is 64, should be 16.  FIXED.
Jul  6 10:23:54 localhost kernel: Initializing CPU#1
Jul  6 10:23:23 localhost fsck: /: Inode 961433, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:23 localhost fsck: /: Inode 961436, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:23 localhost fsck: /: Inode 961445, i_blocks is 64, should be 32.  FIXED.
Jul  6 10:23:54 localhost kernel: masked ExtINT on CPU#1
Jul  6 10:23:23 localhost fsck: /: Inode 961447, i_blocks is 72, should be 24.  FIXED.
Jul  6 10:23:54 localhost kernel: ESR value before enabling vector: 00000000
Jul  6 10:23:23 localhost fsck: /: Inode 961451, i_blocks is 64, should be 8.  FIXED.
Jul  6 10:23:54 localhost xinetd[617]: chargen disabled, removing
Jul  6 10:23:54 localhost kernel: ESR value after enabling vector: 00000000
Jul  6 10:23:54 localhost kernel: Calibrating delay loop... 1992.29 BogoMIPS
Jul  6 10:23:54 localhost xinetd[617]: chargen disabled, removing
Jul  6 10:23:23 localhost fsck: /: Inode 961409, i_blocks is 448, should be
Jul  6 10:23:55 localhost xinetd[617]: daytime disabled, removing
Jul  6 10:23:55 localhost kernel: CPU: L1 I cache: 16K, L1 D cache: 16K
Jul  6 10:23:55 localhost kernel: CPU: L2 cache: 256K
Jul  6 10:23:55 localhost xinetd[617]: daytime disabled, removing
Jul  6 10:23:55 localhost kernel: Intel machine check reporting enabled on CPU#1.
....
 message파일중 일부입니다... 보시면 아시겠지만 4일 17시이후부터 셧다운시점 6일 10시사이의 정보가 없습니다. 
 도대체 무슨 일일까요? 더 필요한 부분이 있으면 알려주십시오.
 --
&#039;와니와 준하&#039;와는 전혀 무관한 와니