Self-Check for Host DDoS Attacks
A cloud host with vulnerabilities may be attacked by hackers and potentially serve as a host for DDoS attacks. This help you perform security self-checks on your cloud host to avoid potential security risks.
PHPMyAdmin
Check
- Whether it is installed
- Whether the /install/ directory has been deleted
- Whether there is a password
Repair
- Enhance mysql password
- Restrict access to phpmyadmin
Tomcat
Check
- Whether the management page /manager/ exists
- Whether the backend uses weak passwords, common weak passwords include admin/admin, tomcat/tomcat, manager/manager
Repair
- If no need to use the tomcat management page, delete it. If necessary, enhance the password. The specific settings are to increase the password strength in conftomact_user.xml
Other Common Open Source CMS
Check
- Whether they are using common open source CMS, dede, and whether the version has vulnerabilities.
- Whether the backend uses weak passwords
Repair
- Upgrade to the latest version
- Enhance password
Struts2
Check
- Whether using Struts2 framework
- Query whether there are vulnerabilities in this version of the Struts2 framework
Repair
- Perform access control on the management backend
- Enhance password
Editor
Check
- Check whether fckeditor is installed
- Whether anyone is allowed to access
- Whether there is a page like fckeditor/editor/filemanager/connectors/test.html fckeditor/editor/filemanager/*
Repair
- Restrict access to fckeditor
- Delete the test page
Common Pages
- Check if ewebeditor is installed, whether the default password is admin, admin888
- There are many problems with ewebeditor itself, it’s recommended to avoid use it if possible
- Repair: Enhance the password. The database of ewebeditor can be downloaded, weak password is useless
FTP Brute Force Cracking
Check
- Whether the FTP has a weak password, check /var/log/vsftpd.log for abnormal logins
Repair
- Enhance password
SSH Weak Password
Check
- Use the last command to check for abnormal logins
- Check /var/log/secure to confirm whether there is brute force cracking, and whether it was successful
Repair
- Enhance password
ElasticSearch
Check
- ElasticSearch 1.2 and below versions enable dynamic script execution by default, leading to being hacked
Repair
Modify the configuration file, add “script.disable_dynamic: true” to disable dynamic script
- Disable dynamic script execution
- Perform access control
SQL Server
Check
- Whether SQL server allows external connections, whether the password strength is sufficient
Repair
- Enhance password
- Perform access control
Windows Remote Desktop
Check
- Whether there is a weak password
Repair
- Enhance password
Open Source Software like mysql, nagios, zabbix, phpmyadmin, cacti, redis, etc.
Check
- If these open source software are used, check the version
- Confirm with the official whether there are vulnerabilities in this version
- Whether these open source software system accounts have weak passwords, or null passwords
Repair
- Upgrade to the latest version
- Perform access control
- Enhance password
- If these service accounts do not need to log into the system with SSH, set the login shell to /sbin/nologin