Linux Systems Being Hit By SSH-Key Attacks

Latest news that Linux had been potentially attack by some of the method it use to steal the SSH key to gain root access to the potential system.

According to US-CERT, the attack appears to rely on stolen SSH keys to gain access to a system. It then uses a local kernel exploit to gain root access, whereupon it installs the "phalanx2" rootkit, derived from the older "phalanx" rootkit.

For more information, please refer to this link

http://www.informationweek.com/news/software/linux/showArticle.jhtml?articleID=210201115

SSH on ESXi

This had been disable by default. Alternatively you can enable following the instruction below:

1. Go to the ESXi console and press alt+F1
2. Type: unsupported
3. Enter the root password
4. At the prompt type vi /etc/inetd.conf
5. Look for the line that starts with #ssh
6. Remove the #
7. Save /etc/inetd.conf by typing :wq!
8. Restart the management service /sbin/services.sh restart

Try it!

Resolution - ESX hosts unexpected disconnect from Virtual Center ( ESX 3.5 update 2 )

When I try to log in to my virtual center to verify my VM farm today, the virtual center show my ESX host had been disconnected from the virtual center by itself. The ESX host itself should be running in critical mode as production and had HA and DRS enable on the cluster. The 1st thing I try to verify is to ensure all my VM and the ESX host is still in production mode, and yes, all the VM is not been down and it still run as normal while it disconnected.

Here is what I did to reconfigure my ESX host and re-join it back to the HA and DRS cluster in my production farm.

Disable the HA and DRS features from the cluster, and totally remove the ESX host from the inventory on Virtual Center server. Follow by that, I SSH in to the ESX host with su -, then I path to the /etc/init.d and look for the services mgmt-vmware status command

It show the services is running. Then I issue the command services mgmt-vmware restart. This will take couple of minutes to get the service fully restarted. At the same time I had actually Remote log on to 1 of the VM to ensure no impact on the VM guest which sit on the ESX host. The result is perfectly work without any downtime on the VM guests, and should credit to the ability from VMware technology.

Once the services restarted, you can easily add host to the virtual center and reconfigure the HA and DRS cluster mode again. The ESX host is back to normal now and work perfectly as usual.