On Mon, 14 Nov 2005, Matt Graham wrote:
> Yikes. Check out what apt-get says when I tell it to upgrade.
>
> That's a big list. Should I be afraid for my system if I say yes? Or do
> I trust apt to do it's thing? Should my system be in any type of runlevel
> when I do this? Can I do this from an ssh session?
Are you running "stable", aka sarge? If so, then go ahead and upgrade if
you want, it should be okay. Changing runlevels isn't necessary. You can
do it from ssh.
But, we don't know that your system has been purged of bad stuff. We
_think_ that there are processes running as the www-data user, but I
didn't see your output from the ps -u www-data command. It seems logical
that your box wasn't rooted, but I'm just guessing from behind an opaque
curtain. There was a local root exploit in the 2.4 and 2.6 kernels about
a year ago, and if your installation is 9 months old or older, you might
well have been rooted.
I just looked it up, versions kernels < 2.4.30 and < 2.6.10 are
vulnerable. If you're running a kernel older than these, reinstall.
Either way, removing awstats removed the access hole, but didn't
necessarily remove anything else that might have been uploaded to your
machine. Bad guys have been using your box, and you don't know what all
they might have done. We are assuming at this point that everything that
they did was done as www-data, your apache owner.
Do a
# find / -user www-data > /tmp/www-data_owned_files.txt
then look through it for funny stuff. But, if your kernel is older than
the versions listed above, reinstall anyway.
That's just my opinion.
-Don