1

my server is hacked and I want a script or anything to get notified by email when any file uploaded or modified in my website I looked at https://stackoverflow.com/questions/35196640/get-notified-when-a-file-got-uploaded-to-server and Best way to monitor file system changes in linux But I didn't understand the way can you guide me step by step please ?

Community
  • 1
  • 1
codezero
  • 13
  • 1
  • 4
  • Sorry, but it is impossible to answer to such a broad question in the question and answer style used here. And a general note: your primary goal should be to prevent that such things happen, so to secure your system! So the primary question here is: _how_ did it happen that someone else modified your files and how can you prevent that in future. – arkascha Jun 07 '16 at 07:55
  • after I looked at access log I figured out how he/she hacked my website but I'm not sure is it's the only way so that i need to know if there any script notify by email me when any file uploaded to my website so i can fix the problem ASAP and prevent the hacker to do anything to my website , database and my server – codezero Jun 07 '16 at 08:00
  • The only way I can think about is to have a cron job creating a checksum over all relevant files and compare that against the previous version. If it differs that means _something_ has changed, why ever. The details of what is possible and how depend on your environment, you will have to add a lot of details to the question. – arkascha Jun 07 '16 at 08:02
  • I mean for example : when someone exploit any file in my website and upload a shell on it I got notification that there is a new file in my website folder + the path of this file , result example : `new file uplodaed path /public_html/images/shell.php ` – codezero Jun 07 '16 at 08:09
  • Yep, we understood what you are looking for. I gave you a hint on how to do it. And asked for more details about your environment. Not about what you want to do... – arkascha Jun 07 '16 at 08:10
  • my server is Linux OS Centos if that what you mean by environment . sorry if I misunderstood your question – codezero Jun 07 '16 at 08:13
  • So it is your own system? That you have administrative control over? Great! Then as said: you need to configure a cron job that executes in a periodic manner. That job executes a script in whatever language you prefer. That script computes a checksum over all your relevant files, something like that: `find somedir -type f -exec md5sum {} \; | sort -k 2 | md5sum`. The final sum has to be stored. If the new value differs from some old value, then something has changed. You also can do that separately for all files obviously. – arkascha Jun 07 '16 at 08:17
  • yes it's my own VPS , and as i see i must to do corn job for all my files right ? – codezero Jun 07 '16 at 08:21
  • One cron job which creates one checksum over all files in a folder and, if you insist, one separate checksum for each file inside that folder. I personally would not check every single file. If _anything_ has been modified you should simply roll back to the last backup. – arkascha Jun 07 '16 at 08:23
  • can you guide me please how can I do it ? – codezero Jun 07 '16 at 08:25
  • As said initially: it is not possible here to explain in detail all steps required. You are expected to be able to use your system, this is a place to ask _specific_ questions. You have all the steps required. If one single step is unclear, then read about it, ask, but in a _specific_ manner. No one here wants to write an endless explanation about every details of your system, sorry. – arkascha Jun 07 '16 at 08:26
  • ok sorry about that and thank you for your time . accept my apologize please – codezero Jun 07 '16 at 08:28
  • All fine, do not get me wrong there. As said: if you have _specific_ questions, ask them. You are welcome. – arkascha Jun 07 '16 at 08:29

1 Answers1

0

I have a simple solution, which also keeps backups of my own changes to the CMS. It works for all the websites I manage (about a dozen, some flat HTML, some Joomla, some Wordpress, on a few different hosts. This has saved me dozens of times, from user error ("hi, I updated my wordpress template and now the whole site is broken") to server-wide hacks ("dear hosting customer, our Plesk was hacked recently, please change all your passwords and check the contents of your sites").

The only requirement : you need access to a Linux machine which is on at least once a day. For me it's the desktop I use every day, but you could run this on your web server itself.

Anyway, here it is:

  • set up all your FTP sites as bookmarks in lftp
  • set up local git repositories for each of the sites you host (git init && git commit -m "first commit")
  • make sure that cron is running (on most systems it is), and that it can email you the results of each job (you'll probably have to redirect you@localhost to your public email address)
  • add this line to crontab

51 03 * * * ~/bin/updateMirrors.sh

  • and save this file as ~/bin/updateMirrors.sh

    #!/bin/bash    
# step through the list of FTP bookmarks, mirror each one.
# seems to take anywhere from 2 to 10 hours
# cron should email the results to you@localhost

while read SITE; 
  do NAME=`echo $SITE|cut -d' ' -f1`;
  echo $NAME `date` ;
  cd ~/$NAME/httpdocs;
  # if there's hackage, try this without the -X *-cache-* lines (someone might evilly install a trojan that looks like a cache file)
  lftp $NAME -e "mirror --verbose -X *-cache-*;quit"|grep -E "Transfer|Permission";
  git add . && git commit -m "updateMirrors.sh"
  echo ---------------------------------------------------------------------------
done <~/.lftp/bookmarks

## if you find hackage, do this:
## git log --name-only
## git checkout [last uuid before hacking started]
## lftp and mirror -eR --exclude .git*

For the last couple of years, every single morning, I get an email in my inbox which looks like this :

wecan.be Tuesday 29 November 05:15:59 AEDT 2016 On branch master nothing to commit, working directory clean
---------------------------------------------------------------------------
handyWarhols Tuesday 29 November 05:17:46 AEDT 2016 On branch master nothing to commit, working directory clean
---------------------------------------------------------------------------
colbourneave Tuesday 29 November 05:17:53 AEDT 2016 Transferring file `components/com_content/models/cache.db'
Transferring file `logs/error.php'
[git_head 657d5dc] updateMirrors.sh
 2 files changed, 141 insertions(+), 2 deletions(-)
---------------------------------------------------------------------------

You can see that the error log was updated for one site. If one of those sites is hacked, it's obvious because there are new files checked in (which I can roll back once I've worked out how it happened). And whenever I or anyone else add content to any of the sites, or if I update a plugin or template, the new files are checked in.

andrew lorien
  • 2,310
  • 1
  • 24
  • 30