Mac OS X Server under attack...

We have an Xserve that has been hacked, and that someone has managed to install a rogue ftp server on. We shut it down, but someone is trying to get it back up again, and I don't know how to stop them.
Any help would be appreciated. Below is as much of the story that I know...
A couple of weeks ago, the server slowed down extremely. It was losing ~70% of packets during a ping, and was responding very slowly on ssh and http. After a while it cleared up, and all seemed fine again.
A few days later, NOC contacted me to find out why I was runnig ftp on a non-standard port (19000). Some investigation revealed that a new folder (.etc) had been installed in the Administrator's home directory, And OpenFTP based server was running from there under the name crashreporterd. It was also doing something on port 16500. A crontab was set up to relaunch the process every 5 minutes.
I cleared all this out, rebooted the system, upgraded to 10.4.7 (from 10.4.6), changed every password on the machine, and started services up again.
This morning at 7am, port 19000 was still closed. At 8:30, I got a note from the NOC saying that the port was open again, and they would block the port at their end.
now, a couple of hours later, the machine is still on, but pings are not returned (100% packet loss) and ssh and http connections time out.
Can anyone offer me any pointers on where to go next or what is happening?

It's hard to say how it happened - maybe looking through system/console logs might help, but that could be a bit of a chore. (There are programs like LogMaster that make this slightly easier). There are any number of ways to get in - SQL injections, buffer overflow 'sploits, or simply guessing the admin password. I'd suggest making a note of which versions you have of all your software and services, and checking them for known vulnerabilities on CERT or SecurityFocus.com.
As for catching the program, there's a shareware program called Little Snitch that will monitor all your software and alert you when a program tries to make a network connection. That way, it's easy to identify legit and dodgy services. CheckMate will also watch your system files and alert you when anything is changed, which can help you identify intrusions. I'd suggest making sure that all your software is fully up-to-date, and revise your firewall policy to allow as little as possible into your system. You can also be a bit selective about which outgoing connections you allow, although these are harder to reliably control.

Similar Messages

2 internal hard drives Mac Pro Tiger Server

I have a mac pro 10.4.11 server that has 2 internal hard drives. 1 is 232.89 GB which is the main startup drive and the second is 465.76 Gb which I had pre installed for extra storage. My question is when I look in Server Admin under sharing and I click the "all" tab. It displays 2 hard drive icons and when you select either one, they consist of the exact same things. Do I need to format the second drive in a way so it will be recognized in the Server Admin Sharing?? I can install applications to the drive as it is recognized in the normal finder but I can't seem to get Server Admin to know it is there. I was going to use the second drive for mostly applications and storage. The other hard drive I was going to try and keep just for home directories.

This is the wrong forum for your topic. You should post it in the Mac OS X Server forum.

Can't login to Mac OS X server website after password reset

Hi,
I set up Mac OS X server for our small company and tried resetting the password of my network account that is managed via profile manager.
So, under Accounts->User->MYUSERNAME->reset Password, I typed in a new one and hit ok.
Now I can't login to the server website anymore (for editing our wiki or using profile manager etc.), neither with the new one nor with the old one.
I already tried different passwords (resetting it again and again), I looked at the password directive, I checked my user name, tried to login from different computers and tried logging in with another account (which worked quite fine, so it's just my account). Finally I searched the internet for a solution for quite some time but didn't find anything similar.
It would be great, if somebody could offer some advice.
Best regards.
Lasse

Solved it by deleting the user and creating a new one with the same userID.
Maybe it occured because I marked the "user has to change password after first login" box when resetting the password but didn't yet allow him to do so in the webpages menu?!?

Mac OS X Server 10.4.10-11 client user problems

It appears that since updating to Mac OS X Server 10.4.10 (and now 10.4.11), running on an XServe G4 with 2GB of RAM, QuarkXPress Passport 6.5 (and also 6.52) crashes at the splash screen when newly created network users launch it on client computers running OS X 10.4.8, 10.4.10 and 10.4.11. QuarkXPress runs fine when logged in as the computer owner with administrator rights.
Users created under Mac OS X Server 10.4.8 do not have this problem and are able to launch QuarkXPress 6.5 or 6.52 without a problem on these same computers.
Quark license verification is supplied by a QLA 4.5 server running on a seperate computer to the OS X Server system.
Can anyone give me any pointers as to what may be causing the crash? A couple of extracts from the crash log are listed below - the full log is available if anyone can decipher it:
Date/Time: 2007-12-05 14:02:19.702 +0000
OS Version: 10.4.11 (Build 8S165)
Report Version: 4
Command: QuarkXPress
Path: /Applications/QuarkXPress 6.5/QuarkXPress Passport.app/Contents/MacOS/QuarkXPress
Parent: WindowServer [53]
Version: QuarkXPress version 6.52 (6.51)
PID: 238
Thread: 0
Exception: EXCBADACCESS (0x0001)
Codes: KERNPROTECTIONFAILURE (0x0002) at 0x00000009
Thread 0 Crashed:
0 libSystem.B.dylib 0x90003ba0 szone_malloc + 616
1 libSystem.B.dylib 0x90003600 malloc + 632
2 com.quark.QuarkXPress 0x00670a0c operator new(unsigned long) + 64
3 com.quark.QuarkXPress 0x00616c98 std::basic_string<char, std::char_traits<char>, std::allocator<char> >::init(char const*, char const, std::allocator<char> const&, std::randomaccess_iteratortag) + 96
4 com.quark.QuarkXPress 0x0062f7ec std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basicstring[in-charge](std::basicstring<char, std::char_traits<char>, std::allocator<char> > const&) + 56
5 com.quark.QuarkXPress 0x00645408 std::_vector_imp<std::basicstring<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, (bool)0>::insert(std::basic_string<char, std::char_traits<char>, std::allocator<char> >*, unsigned long, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) + 872
6 com.quark.QuarkXPress 0x0045eccc PPDPath::SetPPDPath(char**, unsigned char) + 216
7 com.quark.QuarkXPress 0x0045555c PPDMergeOSXAndClassic(char**, char**) + 340
8 com.quark.QuarkXPress 0x004556bc PPDUpdate(unsigned char) + 328
9 com.quark.QuarkXPress 0x004557b4 PPDInit() + 56
10 com.quark.QuarkXPress 0x00016214 initialize() + 19176
11 com.quark.QuarkXPress 0x0048a8e4 main + 224
12 com.quark.QuarkXPress 0x000038d0 _start + 380
13 com.quark.QuarkXPress 0x00003750 _code_start_ + 48
Thread 0 crashed with PPC Thread State 64:
srr0: 0x0000000090003ba0 srr1: 0x000000000200f030 vrsave: 0x0000000000000000
cr: 0x84004444 xer: 0x0000000020000004 lr: 0x0000000090003a00 ctr: 0x0000000090003938
r0: 0x0000000000000008 r1: 0x00000000bfffec70 r2: 0x00000000fffffffe r3: 0x0000000002000038
r4: 0x0000000000000000 r5: 0x0000000005f66510 r6: 0x00000000ffffffff r7: 0x0000000000000001
r8: 0x0000000000000001 r9: 0x0000000000000001 r10: 0x0000000002000054 r11: 0x00000000020000d0
r12: 0x0000000090003938 r13: 0x000000000522d97c r14: 0x0000000000011740 r15: 0x0000000000010032
r16: 0x0000000000000019 r17: 0x000000000000000a r18: 0x00000000bb1a85b2 r19: 0x00000000007cb618
r20: 0x00000000a0003948 r21: 0x00000000ffffffff r22: 0x0000000000000002 r23: 0x0000000000000024
r24: 0x00000000a0003390 r25: 0x0000000005f6653c r26: 0x0000000002000000 r27: 0x0000000005f6653c
r28: 0x0000000000000003 r29: 0x00000000a0003390 r30: 0x0000000005f76d50 r31: 0x0000000090003948

Hi
Have you tried repairing privileges and permissions on the affected clients?
You could also try creating a new admin account on the affected clients and logging in with that. Launch Quark and see if it behaves the same way. If it does not then its more likely some damaged/corrupted plist or preference in the primary admin account’s Home/Library/Preferences folder.
It could also be down to a damaged/corrupted font or Xpress Preferences file. Running the 10.4.10/11 update could be a red herring and its just coincidence that the issues you are seeing happened after the update. Generally an application crashes on launch or when opening a file because its had a problem building the font list or trying to access/load a font when the file has been requested. If your Font Management system is Suitcase remove the Suitcase Preferences folder from /Users/Home/Library/Preferences and restart the mac. Hopefully Quark should now launch. Redefine font sets from there. Quark keeps its Preferences file in /Users/Home/Library/Application Support/Quark.
Of course it could be none of these in which case start looking at drive/directory issues or possibly system issues. You may be looking at an Archive/Reinstall of the OS or Reinstall of the application. Don’t rule out a rebuild either.
Hope this helps, Tony

NetBoot a Mac OS X 10.4 from Mac OS X Server 10.3

Is it possible ?
each time I start netbooting, the iMac G5 displays the spinning globe under the apple for a few seconds and then a kernel panic occured :
+Unable to find driver for this platform: PowerMac8,1+
My image disk was made with DeployStudio and NetBoot image was created with NetWork Image Utility on Mac OS X Server 10.3
Regards,
Didier.

the kernel panic has gone but I can't go after the spinnig globe.
BTW te spinning globe appears 1 second leaving the grey apple logo alone and then fan of the iMac G5 starts its show !
Message was edited by: Didier CHAMBON

External Volume read only on Mac OS X server 10.5

My mac OS X Server 10.5.8 is having a FC volume is read only ,
What could br the issue ??

Same issue here. I even tried to import the cert directly into keychain. I did get the certificate to show up in server admin with the correct signed info, but when I assigned a service to the cert. It actually was handing out the old unsigned cert, so I removed it to try again. Now I cannot get the cert back in server admin at all, just in Keychain under SYSTEM. The self-signed certs only show up under My Keychains... It appears also that Server Admin will only see the certs that are located in MyKeychains. Anyone have any luck?

Update InDesign Server Version on Mac OS X Server

Hi folks,
quick question - quick answer:
How can I update an InDesign Server running on an Mac OS X Server 10.5.8?
Tried to use the installed Extends Script Toolkit, but the menu item under Help->Updates was disabled!
Cheers Tino

Hi folks,
quick question - quick answer:
How can I update an InDesign Server running on an Mac OS X Server 10.5.8?
Tried to use the installed Extends Script Toolkit, but the menu item under Help->Updates was disabled!
Cheers Tino

Can't start mysql 5.5 on MAC OS X server

attempting to start MySQL on Mac OS X server 10.6 fails with following error:
[ERROR] /usr/local/mysql-5.5.8-osx10.6-x86_64/bin/mysqld: unknown option '--skip-locking'
appreciate any advice or help how to fix this problem.
thank you.

I had the same problem when upgrading from MySQL 5.1 to 5.5.
The skip-locking construct was removed in mysql 5.5:
http://dev.mysql.com/doc/refman/5.5/en/mysql-nutshell.html
Search for skip-locking...
I fixed this by editing /etc/my.cnf. Under [mysqld], change "skip-locking" to "skip-external-locking".
It might be worth your while to grab a new my.cnf from /usr/local/mysql/support-files. There are several default configuration options to choose from. I'm still running my customized version from 5.1, but I'm guessing there are changes that I haven't encountered yet.
Good luck.

Mac OS X Server Tiger and Windows XP SP2 (Yes I know not a good Idea)

Hi Everybody
I have an issue. It have setup all the windows services as is said in the apple guid and I can't get it to work.
It seams to be having trouble connecting to the server / finding the server. And guesses on why this mite be. I have had issues with the DNS on the PC's as well however it works fine on the Mac's.

Not very specific about your problem.
But I think it may because you need the Win clients to use the tiger server as a WINS box.
In your windows IP settings enter the ip of the server under 'WINS'
AlanP

WLC sending a message of AP under attack

Hi to all,
I've been getting this message from my WLC and I'm not able to find what doest it really mean and if there is something that could be done in order to solve it.
"Warning : Our AP with Base Radio MAC 00:14:a8:53:0b:20 is under attack (contained) by another AP on radio type 802.11b/g"
"Warning Cleared: Our AP with Base Radio MAC 00:14:a8:53:0b:20 is no longer under attack (contained) by another AP on radio type 802.11b/g"
Can this cause me problems in the performance of my wireless network???
Thanks in advance for your help.

Hi,
The firmware is 4.2.112.0
Thanks in advance for your help.

Mac OS X Server 4.1, Xcode 6.3.1 "This version of Xcode cannot be used with this server"

I'm utterly confused.
The documentation for Mac OS X Server (from https://help.apple.com/serverapp/mac/4.0/#/apdA154F061-7CE4-4A58-843D-DC2CE3A1AE 8C ) shows that Xcode 6 or later (my emphasis). I have installed Mac OS X 10.10.3, Mac OS X Server 4.1, Xcode 6.3.1. I have no apps in the App Store's "Update" tab that need to be updated (just now double-checked). I clicked to the Xcode tab under "Services" in OS X Server, clicked the "Choose Xcode…" button, selected the version of Xcode from the Applications folder on the root HDD, and got the error message "This version of Xcode cannot be used with OS X Server."
So .... now what?

Well, for some reason it just started working. I was busy trying to fix another issue when I noticed that the Xcode service was running. I would still like to know what happened in case I have a similar problem with the next OS/Server upgrade, but for now it's at least running.

Push e-Mail Service into iPhone out of Mac OS X Server?

Will there be a push e-mail (calendar and address book) function in Mac OS X Server soon? Will there be possibilities to use Microsoft's ActiveSync-protocol under Server?
It shouldn't be that only PC-enterprise users can use the new iPhone enterprise functions, or should it?
Thanks
Joe

Hello,
Is there a way to have push email with macosx Server 10.5 and the iphone ? We have all our business on xserve + MacosX server, for the purpose of good interoperability between apple products. But if we can't get push emails between macosx server and iphone this is really a pity. It means we should have gone with Microsoft SMB + exchange ??? I really don't understand the apple politic !!! Apple if you read this, please make an effort toward your business client, bring good tools with good interoperability !!! The equivalent to "mobile me" should be available as an enterprise product.
Regards,
Numa

Used Mac OS X server no name or password

Hello! I had purchased a used MAc OS X server, and it did not come with the Name or password. Any way to change or bypass?

Before buying a second-hand computer, you should have run Apple Diagnostics or the Apple Hardware Test, whichever is applicable.
The first thing to do after buying the computer is to erase the internal drive and install a clean copy of OS X. You—not the original owner—must do that. Changes made by Apple over the years have made this seemingly straightforward task very complex.
How you go about it depends on the model, and on whether you already own another Mac. If you're not sure of the model, enter the serial number on this page. Then find the model on this page to see what OS version was originally installed.
It's unsafe, and may be unlawful, to use a computer with software installed by a previous owner.
1. If you don't own another Mac
a. If the machine shipped with OS X 10.4 or 10.5, you need a boxed and shrink-wrapped retail Snow Leopard (OS X 10.6) installation disc from the Apple Store or a reputable reseller—not from eBay or anything of the kind. If the machine is very old and has less than 1 GB of memory, you'll need to add more in order to install 10.6. Preferably, install as much memory as it can take, according to the technical specifications.
b. If the machine shipped with OS X 10.6, you need the installation media that came with it: gray installation discs, or a USB flash drive for a MacBook Air. You should have received the media from the original owner, but if you didn't, order replacements from Apple. A retail disc, or the gray discs from another model, will not work.
To start up from an optical disc or a flash drive, insert it, then restart the computer and hold down the C key at the startup chime. Release the key when you see the gray Apple logo on the screen.
c. If the machine shipped with OS X 10.7 or later, you don't need media. It should start up in Internet Recovery mode when you hold down the key combination option-command-R at the startup chime. Release the keys when you see a spinning globe.
d. Some 2010-2011 models shipped with OS X 10.6 and received a firmware update after 10.7 was released, enabling them to use Internet Recovery. If you have one of those models, you can't reinstall 10.6 even from the original media, and Internet Recovery will not work either without the original owner's Apple ID. In that case, contact Apple Support, or take the machine to an Apple Store or another authorized service provider to have the OS installed.
2. If you do own another Mac
If you already own another Mac that was upgraded in the App Store to the version of OS X that you want to install, and if the new Mac is compatible with it, then you can install it. Use Recovery Disk Assistant to prepare a USB device, then start up the new Mac from it by holding down the C key at the startup chime. Alternatively, if you have a Time Machine backup of OS X 10.7.3 or later on an external hard drive (not a Time Capsule or other network device), you can start from that by holding down the option key and selecting it from the row of icons that appears. Note that if your other Mac was never upgraded in the App Store, you can't use this method.
3. Partition and install OS X
a. If you see a lock screen when trying to start up from installation media or in Recovery mode, then a firmware password was set by the previous owner, or the machine was remotely locked via iCloud. You'll either have to contact the owner or take the machine to an Apple Store or another service provider to be unlocked. You may be asked for proof of ownership.
b. Launch Disk Utility and select the icon of the internal drive—not any of the volume icons nested beneath it. In the Partition tab, select the default options: a GUID partition table with one data volume in Mac OS Extended (Journaled) format. This operation will permanently remove all existing data on the drive.
c. An unusual problem may arise if all the following conditions apply:
          OS X 10.7 or later was installed by the previous owner
          The startup volume was encrypted with FileVault
          You're booted in Recovery mode (that is, not from a 10.6 installation disc)
In that case, you won't be able to unlock the volume or partition the drive without the FileVault password. Ask for guidance or see this discussion.
d. After partitioning, quit Disk Utility and run the OS X Installer. If you're installing a version of OS X acquired from the App Store, you will need the Apple ID and password that you used. When the installation is done, the system will automatically restart into the Setup Assistant, which will prompt you to transfer the data from another Mac, its backups, or from a Windows computer. If you have any data to transfer, this is usually the best time to do it.
e. Run Software Update and install all available system updates from Apple. To upgrade to a major version of OS X newer than 10.6, get it from the Mac App Store. Note that you can't keep an upgraded version that was installed by the original owner. He or she can't legally transfer it to you, and without the Apple ID you won't be able to update it in Software Update or reinstall, if that becomes necessary. The same goes for any App Store products that the previous owner installed—you have to repurchase them.
4. Other issues
a. If the original owner "accepted" the bundled iLife applications (iPhoto, iMovie, and Garage Band) in the App Store so that he or she could update them, then they're irrevocably linked to that Apple ID and you won't be able to download them without buying them. Reportedly, Mac App Store Customer Service has sometimes issued redemption codes for these apps to second owners who asked.
b. If the previous owner didn't deauthorize the computer in the iTunes Store under his Apple ID, you wont be able to authorize it immediately under your ID. In that case, you'll either have to wait up to 90 days or contact iTunes Support.
c. When trying to create a new iCloud account, you might get a failure message: "Account limit reached." Apple imposes a lifetime limit of three iCloud account setups per device. Erasing the device does not reset the limit. You can still use an iCloud account that was created on another device, but you won't be able to create a new one. Contact iCloud Support for more information. The setup limit doesn't apply to Apple ID accounts used for other services, such as the iTunes and Mac App Stores, or iMessage. You can create as many of those accounts as you like.

Can Mac Pro run AHCI under Windows? No native command queuing?

It seems that Mac Pro runs AHCI under OS X.
Under Windows Vista 32/64 or XP 32/64, some reason AHCI cannot be enabled. It seems to only run legacy IDE mode. Even with modern HD, Mac Pro can not seems to take advantage of AHCI benefits such as hot-plugging and native command queuing. Does Apple thinks that native command queuing is necessary feature under OS X but not under Windows?
Even with installing AHCI driver using F6 during Windows installation, AHCI mode cannot be obtained.
Is there a simple way to enable AHCI mode besides modifying the grub bootloader as some suggested in forum? Or is it not possible until Apple modifies BIOS CSM or allows EFI modification? It seems that Apple wont address this issue with firmware update since Intel Mac Pros have been available for years now.
Any suggestion of enabling AHCI under windows XP / Vista will be welcomed.

HD Tune wont expect to show any change with or without NCQ.
NCQ will show advantage in server environment or heavy multi-tasking environment, not on I/O meter. NCQ may even slow some game playing in some instance.
AHCI adds other stuff like hotswapping or other modern goodies, not just NCQ.
Mac Pro has Intel chip / controller capable of AHCI and RAID (well pseudo Intel Matrix RAID) only if Apple allows us to enble it in EFI.

WLC Warning Message: Our AP is under attack

Hi there,
I receive this Warning message in WLC version 5.0:
Warning: Our AP with Base Radio MAC 00:1f:6d:b9:48:d0 is under attack (contained) by another AP on radio type 802.11b/g
So, what does it means? Can someone explain..Great Thanks.

I am getting the same message, but I've not been able to diagnose the issue yet.
It seems that the AP is being contained by another wireless system. However, there is no information that I can find to indicate what is "attacking" or "containing" the AP.

Mac OS X Server under attack...

Similar Messages

Maybe you are looking for