cPanelPeter
commented
2 years ago I'm not able to reproduce this on CentOS 7. `# ./csi.pl [INFORMATIONAL]: CSI version: 3.5.9 Checking for a previous run of CSI [INFORMATIONAL]: Setting I/O priority to reduce system load: best-effort: prio 6
Scan started on Fri Mar 18 13:08:38 2022 [INFORMATIONAL]: Usage: /root/csi.pl [functions] [options] [INFORMATIONAL]: See --help for a full list of options
########################################################################
DISCLAIMER! cPanel's Technical Support does not provide
security consultation services. The only support services we
can provide at this time is to perform a minimal analysis of the
possible security breach solely for the purpose of determining if
cPanel's software was involved or used in the security breach.
########################################################################
As with any anti-malware scanning system false positives may occur
If anything suspicious is found, it should be investigated by a
professional security consultant. There are never any guarantees
########################################################################
Checking for RPM database corruption and repairing as necessary...
[ Starting cPanel Security Investigator SCAN Mode ] [ System: Centos Linux release 7.9 ]
[ Available flags when running csi.pl scan ] [ --full Performs a more compreshensive scan (includes the options below)] [ --shadow Scans all accounts for variants of shadow.roottn email hack ] [ --symlink Scans for symlink hacks going back to / ] [ --secadv Performs a Security Advisor run ]
[ Checking logfiles ] [ Checking for bad UIDs ] [ Checking /etc/passwd file for suspicious users ] [ Checking /etc/hosts file for suspicious entries ] [ Checking for known Indicators of Compromise (IoC) ] [ Checking for evidence of DirtyCow within /etc/passwd ] [ Checking installed packages for CVEs ] [ Checking if polkit/policykit has been exploited by CVE-2021-4034 ] [ Checking if Use MD5 passwords with Apache is disabled ] [ Checking for index.html in /tmp and /home ] [ Checking for modified suspended page ] [ Checking for suspicious files ] [ Checking if root bash history has been tampered with ] [ Checking /etc/ld.so.preload for compromised library ] [ Checking process list for suspicious processes ] [ Checking for suspicious bitcoin miners ] [ Checking reseller ACLs ] [ Checking if /var/cpanel/authn/api_tokens_v2/whostmgr/root.json is IMMUTABLE ] [ Checking /usr/local/cpanel/logs/api_tokens_log for passwd changes ] [ Checking for PHP backdoors in unprotected path ] [ Checking for miscellaneous compromises ] [ Checking Binary Headers ] [ Checking Apache Modules ] [ Checking for sshd_config ] [ Checking vm.nr.hugepages in /proc/sys/vm ] [ Checking for modified/hacked SSH ] [ Checking /root/.bash_history for anomalies ] [ Checking for non-root users with ALL privileges in /etc/sudoers file ] [ Checking for spam sending script in /tmp ] [ Checking user level crons for suspicious entries ] [ Checking for ransomwareEXX ] [ Checking kernel status ] [ Checking for suspicious MySQL users (Including Super privileges) ] [ Checking for unowned files/libraries ] [ Checking /etc/group for suspicious users ]
Looking for recommendations
[ Checking if updates are enabled ] [ Checking for mod_security ] [ Checking for Two-Factor Authentication ] [ Checking login_access Tweak Setting ] [ Checking for accesshash ] [ Checking if SymLinkProtection is enabled ] [ Checking setting of Cookie IP Validation ] [ Checking setting of X-Frame/X-Content Type headers with cpsrvd ] [ Checking for deprecated plugins/modules ] [ Gathering the IP addresses that logged on successfully as root ] [ cPanel Security Investigator Complete! ] [ CSI Summary ]
Congratulations, no negative items found!
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [INFORMATIONAL]: The following is just informational
The following IP address(es) logged on via SSH successfully as root (in Mar): _ IP: 10.3.9.90 _ IP: 10.3.9.74 _ IP: 10.3.9.68 _ IP: 10.3.9.63 _ IP: 10.3.9.17 _ IP: 10.3.9.253 _ IP: 10.3.9.249 _ IP: 10.3.9.216 _ IP: 10.7.10.236 _ IP: 10.3.9.183 _ IP: 10.3.9.173
Do you recognize the above IP addresses? If not, then further investigation should be performed by a qualified security specialist. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [RECOMMENDATIONS]: You should consider making the following recommendations:
PermitRootLogin is set to yes in /etc/ssh/sshd_config - consider setting to no or without-password instead! PasswordAuthentication is set to yes in /etc/ssh/sshd_config - consider using ssh keys instead! Mod Security is installed but there were no active Mod Security vendor rules found. Two-Factor Authentication Policy is disabled - Consider enabling this. Consider changing Accounts that can access cPanel user account to cPanel User Only.
Scan completed on Fri Mar 18 13:09:23 2022 Elapsed Time: 45 seconds`
Please run csi.pl with the --debug flag (lots of info will be printed, but if there are errors during the suspicious process check, it should tell you.
evrynet1
It looks like the script is broken under CentOS 7 and exit at "Checking process list for suspicious processes". Could you look into this please?
Thank you