# Is my site getting hacked? **URL:** \ **Category:** Rails\ **Created:** [May 10, 2007, 2:12am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764 "2007-05-10T02:12:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 10, 2007, 2:12am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/1 "2007-05-10T02:12:11Z")
I tried to ssh into a site that I have and was greeted with an error message: -bash: fork: Resource temporarily unavailable -bash-2.05b$ After sending a ticket to my host, I get a response saying the following: ``` Someone is exploiting the code on yoru site to run local things ``` in /tmp, not sure how they’re exploiting it, but they sit in the background, and thus you get the fork warning. Being fairly new to RoR, I went through everything I could think of… checking to make sure permissions are correct, looking through log files, etc, and came up with nothing. I tried getting more info from the host, to find out what was running and if there was any more information I could get to try and stop it and this is what he says back: ``` Not sure what they're running, whatever it is deletes the source ``` after it’s started. It hides itself as exim queue runners. Has anyone had problems like this? I have no idea what I can do to track this down or if it’s something even caused by my rails site in the first place. It’s running v1.1.6 on CentOS 3.8 if any of that helps. Through my searching I found this article: > **[Rails 1.1.6, backports, and full disclosure](https://rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure)** > > The cat is out of the bag, so here’s the full disclosure edition of the current security vulnerability. With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the... but have no idea if that even has anything to do with the problems that I am having now. ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 10, 2007, 5:20am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/2 "2007-05-10T05:20:21Z")
The immediate question is probably: how did they get in? If you have a virtual host you haven’t locked down then there are a huge number of vectors for getting access. -faisal ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 10, 2007, 5:23am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/3 "2007-05-10T05:23:21Z")
Also, if at all possible you want to take the site offline to do forensics, and possibly do a clean reinstall. -faisal ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 11, 2007, 1:00am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/4 "2007-05-11T01:00:45Z")
On May 9, 2007, at 5:11 PM, Josh wrote: > ``` > Someone is exploiting the code on yoru site to run local things > > ``` > > in /tmp, not > sure how they’re exploiting it, but they sit in the background, > and thus you > get the fork warning. Josh- You absolutely can’t trust anything on that server anymore. You shoudl make a backup of your data and stuff you need and then wipe the server and reinstall. Once you are compromised you cannot trust the system any more period. The only safe thing to do is wipe clean and reinstall. Cheers- – Ezra Z. – Lead Rails Evangelist – removed\_email\_address@domain.invalid – Engine Y., Serious Rails Hosting – (866) 518-YARD (9273) ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 11, 2007, 1:17am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/5 "2007-05-11T01:17:46Z")
Any ideas how it happened in the first place? I’m fine with wiping it clean, but I want to make sure that if it was something that I did, I won’t do it again. Or at least know what things to watch for. Thanks for the reply Josh ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 11, 2007, 1:40am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/6 "2007-05-11T01:40:49Z")
Always worthwhile setting up Samhain ([http://www.la-samhna.de/](http://www.la-samhna.de/) samhain/) on a new box 🙂 ---
**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\ **Post date:** [May 12, 2007, 9:24am UTC](https://www.ruby-forum.com/t/is-my-site-getting-hacked/103764/7 "2007-05-12T09:24:08Z")
Need more information. RoR itself is pretty secure if you haven’t inadvertently coded in any code/sql injection or XSS holes. Are you treating user-provided input as SQL or ruby/system calls without escaping it? Maybe they got in another way? Are you passwords secure? If you have sshd listening to port 22 and have very simple usernames and passwords, you’re liable to get hacked.