Help needed troubleshooting and restoring my Linode Service
Support Tickets from Linode:
We have detected an outbound denial of service attack originating from your Linode. It appears that a process internal to your Linode is sending large amounts of malicious traffic towards other servers. We ask that you investigate this matter as soon as possible to determine why this activity is originating from your Linode.
If you were not aware that activity of this nature was originating from your Linode, it is likely that your Linode has been compromised, and you'll want to take appropriate action.
Follow Up.
Thank you for calling Linode today. If you are unable to determine the source of these attacks, your Linode has most likely been compromised. If this is the case, we would not recommend booting into the compromised disk images. You should back up your data and delete the compromised disk images as soon as possible. For instructions on how to do this with the least amount of downtime possible, you can refer to the following guide:
2 Replies
If you want a quick fix I wouldn't mind having a look on your Linode. Stopping/removing the script that causes the DoS is normally not a huge issue, they're pretty noisy. It'll be more time to fix the actual issue that they used to compromise the system. It might be something small like a vulnerability in a website you run, but if you're unlucky and they got root access you'll have to rebuild your Linode.
Either way, if the underlying issue isn't fixed it can come back. If it came in through your website it can be somewhat mitigated with things like open_basedir and disabled PHP functions, but that does not stop them from messing with your website and databases, only that they can't do anything outside of your site.
Are you running a CMS or something custom-made? Wordpress/Joomla/Drupal, etc?
Could you also post screenshots of your CPU/Network graph in the Linode manager? That should help to determine the time when the DoS started.
