0

I have a server centOS 5.9 i386. I contacted cPanel for some issue, so they informed me that my server had been compromised and /lib64/libkeyutils-1.2.so.2 is the direct indication that the server has been hacked. So, I followed the instructions from here and removed the file, but I think i did not linked the libkeyutil with the previous version so when I restarted SSH, the server denided the access with a message i.e. (Server unexpectedly closed network connection). Now I cannot access my server over ssh. But I access my server with KVM console, so I logged into my server to reinstall keyutils but yum is not working now. It gives me error i.e.

Traceback (most recent call last):
  File "/usr/bin/yum", line 4, in ?
    import yum
  File "/usr/lib/python2.4/site-packages/yum/__init__.py", line 50, in ?
    import config
  File "/usr/lib/python2.4/site-packages/yum/config.py", line 27, in ?
    from parser import ConfigPreProcessor
  File "/usr/lib/python2.4/site-packages/yum/parser.py", line 3, in ?
    import urlgrabber
  File "/usr/lib/python2.4/site-packages/urlgrabber/__init__.py", line 53, in ?
    from grabber import urlgrab, urlopen, urlread
  File "/usr/lib/python2.4/site-packages/urlgrabber/grabber.py", line 412, in ?
    import keepalive
  File "/usr/lib/python2.4/site-packages/urlgrabber/keepalive.py", line 339, in ?
    class HTTPSHandler(KeepAliveHandler, urllib2.HTTPSHandler):
AttributeError: 'module' object has no attribute 'HTTPSHandler'

Unfortunately I restarted the server machine (I though it will configure itself), now apache cannot be started, it gives me the following error

/usr/local/pache/bin/httpd: error while loading shared libraries: 
libkeyutils.so.1: cannot shared object file: No such file or directory

Now, all the sites are down as apache is not up.

I tried to reinstall yum using rpm following the instructions here

Need Help In:

Can I get back the file i removed (which is /lib64/libkeyutils-1.2.so.2) ?

How can I install keyutils without yum?

Please help. Thanks

AL̲̳I
  • 105

1 Answers1

3

If you did not have the compromised libkeyutils.so.1.9 library on your system then you can download the CentOS 5.9 rpm for the libs from here or use wget to get it. Once you've done this use

rpm -Fvh keyutils-libs-1.2-1.el5.i386.rpm

to install it.

If you did haver the compromised libkeyutils.so.1.9 library then you really should wipe it and reinstall from a known good backup.

user9517
  • 117,122