[Imc-tech] Website Down

[Bryan Cribbs]

It was running so much that couldn't respond to anything -- the 
load on the machine was up around 80...

I restarted Apache, and it's running normally again for now.

* Wendy Edwards <wedwards at uiuc.edu> :
> The IMC web server may be down again.
> 
> wendy
> 
> On Wed, Sep 14, 2005 at 02:13:32AM -0500, Zachary C. Miller wrote:
> > Yes. I had the server down all day for diagnostics due to the fact
> > that the server was dead this morning in the same way it was a few
> > days ago. I also discovered a root kit (root was not gained, afaict,
> > but the web user was compromised and used to launch attack attempts on
> > other sites) on the server yesterday. I needed to find out whether a
> > security hole was responsible for the crash this morning or whether a
> > hardware problem was at fault.
> > 
> > I ran low level comprehensive memory and disk scans on the server
> > which took all day to complete. 
> > 
> > I've determined that one of our disks is definitely dying. Luckily the
> > only data on that disk was our daily backups so no data has been
> > lost. But until I replace it (hopefully tomorrow...meaning another
> > hour of downtime) we are running without daily backups. In the mean
> > time I am running a manual backup to another machine. 
> > 
> > I do not think the rootkit was related to these outages and I believe
> > that nothing was compromised on the system and I believe that I have
> > patched the security hole that was used to get in but I am not certain
> > about any of this. I remain watchful.
> > 
> > Bryan Cribbs wrote:
> > > I'm sure Zach can give a more comprehensive report, 
> > > the server has been killed twice in the last 4 days.
> > > It's not yet clear what's up.  Last time it died I 
> > > talked to Zach and he was running diagnostics on the server.
> > > 
> > > (note: forgive my jargon of "killed" and "died"... 
> > > I have not seen anything suggesting malicious intent).
> > > 
> > > * Mike Lehman <rebelmike at earthlink.net> :
> > > > I ahve been unable to reach the website for the last hour or so, at
> > > > home or office.
> > > > Mike Lehman
> > > > _______________________________________________
> > > > Imc-tech mailing list
> > > > Imc-tech at lists.ucimc.org
> > > > http://lists.chambana.net/cgi-bin/listinfo/imc-tech
> > > _______________________________________________
> > > Imc-tech mailing list
> > > Imc-tech at lists.ucimc.org
> > > http://lists.chambana.net/cgi-bin/listinfo/imc-tech
> > > 
> > 
> > -- 
> > Zachary C. Miller - @= - http://zach.chambana.net/
> > IMSA 1995 - UIUC 2000 - Just Another Leftist Muppet - Ya Basta!
> >  Social Justice, Community, Nonviolence, Decentralization, Feminism,
> >  Sustainability, Responsibility, Diversity, Democracy, Ecology
> > _______________________________________________
> > Imc-tech mailing list
> > Imc-tech at lists.ucimc.org
> > http://lists.chambana.net/cgi-bin/listinfo/imc-tech