Synology corregge una vulnerabilità di sicurezza

[alexfs]

Salve a tutti ho bisogno di qualche aiuto

in riferimento a quanto riportato qui
avvisi-dal-forum/synology-corregge-una- ... t4422.html

io ho notato nel'ultmo mese appunto un
questo evento
Utilizzo eccezionalmente elevato della CPU nel Resource Monitor

ma non sono in grado di verificare
i seguenti punti ..
Apparizione di una cartella non-Synology:
Una cartella condivisa viene creata automaticamente con il nome di "startup", o una cartella non-Synology appare sotto "/ root / PWNED"
• Reindirizzamento di Web Station:
"Index.php" viene reindirizzato a una pagina inaspettato
• Apparizione del programma CGI non-Synology:
I file con nomi senza senso in "/ usr / syno / synoman"
• Apparizione di un file script non-Synology:
Un file script non-Synology, come "S99p.sh", appare sotto "/ usr / syno / etc / rc.d"

devo utilizzare il collegmanto shh... con putty...
e quali comandi devo dare ..per verificare da terminale ...?


proprio ieri ho aggiornato alla versione DSM 4.3-3827; Data Build : 2014-02-14
sul modello ds112+

può bastare

cosa vuol dire eseguire questa procedura..?
Per DiskStation o RackStation funzionando su DSM 4.3 , si prega di seguire le istruzioni indicate qui per reinstallare DSM 4,3-3827 .
http://www.synology.com/it-it/support/faq/348
perdo tutte le impostazioni.....di rete , vpn , firewall , ecc .ecc

questa storia mi preoccupa , perchè il Nas è acceso sempre... esapee che
fa le bizze... mi preoccupa....

[alexfs]

ok
per verificare
ho trovato i comandi qui
guide-tips/guida-comandi-base-linux-da- ... h-t56.html

per ora non ho trovato i processi e i file sospetti....

[alexfs]

io q mi trovo questi processi
voi vedete qualche cosa di grave....??

Codice: Seleziona tutto

  PID  PPID USER     STAT   VSZ %MEM %CPU COMMAND
11999     1 root     S    65456 12.7  0.2 /var/packages/SurveillanceStation/target/sbin/ssd -c 2
 4274     1 root     S    14704  2.8  0.2 /usr/syno/sbin/snmpd -Ln -c /usr/syno/etc/snmpd.conf -p /var/run/snmpd.pid udp:161,udp6:161,tcp:161,tcp6:1
 4849  4780 admin    S     110m 22.0  0.0 /usr/syno/mysql/libexec/mysqld --basedir=/usr/syno/mysql --datadir=/volume1/@database/mysql --user=admin -
10787     1 root     S    87944 17.1  0.0 /var/packages/MediaServer/target/sbin/dms
11160     1 root     S <  80332 15.6  0.0 /var/packages/AudioStation/target/bin/pulseaudio
11152     1 root     S <  66776 13.0  0.0 /var/packages/AudioStation/target/sbin/synoaudiod
12294     1 root     S    64632 12.6  0.0 /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18513 12294 nobody   S    64632 12.6  0.0 /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18511 12294 nobody   S    64632 12.6  0.0 /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18512 12294 nobody   S    64632 12.6  0.0 /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
11986     1 root     S    61092 11.9  0.0 /var/packages/SurveillanceStation/target/sbin/vsctrld
11964     1 root     S    59108 11.5  0.0 /var/packages/SurveillanceStation/target/sbin/sscored
11721     1 root     S    54576 10.6  0.0 /var/packages/VPNCenter/target/sbin/vpnauthd
24216  4748 admin    S    34788  6.7  0.0 postgres: admin mediaserver [local] idle
24227  4748 admin    S    34468  6.7  0.0 postgres: admin mediaserver [local] idle
 4752  4748 admin    S    33896  6.6  0.0 postgres: writer process
 4748     1 admin    S    33768  6.6  0.0 /usr/syno/pgsql/bin/postgres -D /var/services/pgsql --config_file=/usr/syno/pgsql/etc/postgresql.conf --hb
 4753  4748 admin    S    33768  6.6  0.0 postgres: wal writer process
 5209     1 root     S    28332  5.5  0.0 /usr/syno/sbin/smbd -D
 5222  5209 root     S    28332  5.5  0.0 /usr/syno/sbin/smbd -D
10973     1 root     S N  27608  5.3  0.0 /usr/syno/sbin/synoindexd
11973     1 root     S    27288  5.3  0.0 /var/packages/SurveillanceStation/target/sbin/ssrotated
11977     1 root     S <  27280  5.3  0.0 /var/packages/SurveillanceStation/target/sbin/ssfindhostd
10978     1 root     S N  26520  5.1  0.0 /usr/syno/bin/synomkthumbd
10983     1 root     S N  26516  5.1  0.0 /usr/syno/sbin/synomkflvd
 5173     1 root     S    21888  4.2  0.0 /usr/syno/sbin/nmbd -D
16411  5434 root     S    19572  3.8  0.0 sshd: root@pts/2
 2879     1 root     S    18324  3.5  0.0 scemd
10809     1 root     S    16308  3.1  0.0 /var/packages/MediaServer/target/sbin/lighttpd -f /var/packages/MediaServer/target/etc/lighttpd.conf -m /v
10897     1 root     S    15520  3.0  0.0 /var/packages/SyslogServer/target/sbin/logdispatchd
 5232     1 root     S    14812  2.8  0.0 /usr/syno/sbin/afpd -g guest -c 256 -n Synology112 AFPServer -l default log_error
 5582     1 root     S    14184  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-sys
 5601  5582 root     S    14184  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-sys
 5602  5582 root     S    14184  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-sys
18643  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
18571  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
18572  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
18755  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
18644  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
18640  5469 root     S    13824  2.7  0.0 /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
Synology112>

[alexfs]

forse dovevo dare il comando ps
c'è qualcosa di anomalo??

Codice: Seleziona tutto

Synology112> ps
  PID USER       VSZ STAT COMMAND
    1 root      2692 S    /sbin/init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [events/0]
    5 root         0 SW   [khelper]
    8 root         0 SW   [async/mgr]
   95 root         0 SW   [sync_supers]
   97 root         0 SW   [bdi-default]
   98 root         0 SW   [kblockd/0]
  104 root         0 SW   [ata/0]
  105 root         0 SW   [ata_aux]
  120 root         0 SW   [rpciod/0]
  128 root         0 SW<  [kswapd0]
  129 root         0 SW   [nfsiod]
  130 root         0 SW   [crypto/0]
  287 root         0 SW   [scsi_eh_0]
  289 root         0 SW   [scsi_eh_1]
  295 root         0 SW   [mtdblockd]
  324 root         0 SW   [kstriped]
  436 root         0 SW   [flush-8:0]
  737 root         0 SW   [jbd2/sda1-8]
  738 root         0 SW   [ext4-dio-unwrit]
  755 root      7272 S    /usr/sbin/syslog-ng -F
 1852 root         0 SW   [khubd]
 1855 root         0 SW   [kethubd]
 1914 root         0 SW   [ksnapd]
 2034 root         0 SW   [crypto]
 2035 root         0 SW   [crypto_ret]
 2144 root         0 SW   [ecryptfs-kthrea]
 2784 root      9456 S <  /usr/syno/bin/findhostd
 2810 root         0 SW   [jbd2/sda3-8]
 2811 root         0 SW   [ext4-dio-unwrit]
 2879 root     18324 S    scemd
 3013 root         0 DW   [xhci_thread]
 3352 root         0 SW   [usbhid_resumer]
 3520 root      4076 S    /sbin/getty 115200 console
 4197 root      2396 S    /usr/syno/sbin/dbus-daemon --system --nopidfile
 4199 root      2396 S    /usr/syno/sbin/dbus-daemon --session --fork --print-address
 4227 root      9344 S    /usr/syno/sbin/hotplugd
 4255 root      4144 S    /usr/sbin/inetd
 4261 root      4144 S    /usr/sbin/crond
 4274 root     14704 S    /usr/syno/sbin/snmpd -Ln -c /usr/syno/etc/snmpd.conf -p /var/run/snmpd.pid u
 4278 root     13192 S    /usr/syno/sbin/ddnsd
 4713 root     12800 S    /usr/syno/sbin/synorelayd
 4748 admin    33768 S    /usr/syno/pgsql/bin/postgres -D /var/services/pgsql --config_file=/usr/syno/
 4752 admin    33896 S    postgres: writer process
 4753 admin    33768 S    postgres: wal writer process
 4780 root      4072 S    /bin/sh /usr/syno/mysql/bin/mysqld_safe --datadir=/volume1/@database/mysql -
 4849 admin     110m S    /usr/syno/mysql/libexec/mysqld --basedir=/usr/syno/mysql --datadir=/volume1/
 4905 root      8520 S    /usr/sbin/ntpd -p /var/run/ntpd.pid -g
 4992 root      8848 S    /usr/syno/sbin/cupsd -C /usr/local/cups/cupsd.conf
 5054 root     13148 S N  /usr/syno/sbin/fileindexd
 5173 root     21888 S    /usr/syno/sbin/nmbd -D
 5209 root     28332 S    /usr/syno/sbin/smbd -D
 5222 root     28332 S    /usr/syno/sbin/smbd -D
 5230 root      7888 S    /usr/syno/sbin/cnid_metad -l log_error
 5232 root     14812 S    /usr/syno/sbin/afpd -g guest -c 256 -n Synology112 AFPServer -l default log_
 5325 root      2064 S    /sbin/rpcbind
 5327 root      2988 S    /usr/sbin/mountd -p 892
 5334 root         0 SW   [lockd]
 5335 root         0 SW   [nfsd4]
 5336 root         0 SW   [nfsd]
 5337 root         0 SW   [nfsd]
 5338 root         0 SW   [nfsd]
 5339 root         0 SW   [nfsd]
 5345 root      2500 S    /usr/sbin/idmapd
 5358 root      2668 S    /usr/sbin/statd
 5402 root     12776 S    /usr/syno/sbin/synosnmpcd
 5434 root     12324 S    /usr/syno/sbin/sshd
 5469 root     13564 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
 5582 root     14184 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-
 5601 root     14184 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-
 5602 root     14184 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd-webdav.conf-
 5665 root      3744 S    avahi-daemon: running [Synology112.local]
 6054 root         0 SW<  [kslowd000]
 6136 root         0 SW<  [kslowd001]
 6561 root         0 SW   [cifsd]
10787 root     87944 S    /var/packages/MediaServer/target/sbin/dms
10809 root     16308 S    /var/packages/MediaServer/target/sbin/lighttpd -f /var/packages/MediaServer/
10893 root      3600 S    supervising syslog-ng
10894 root      7880 S    /sbin/syslog-ng --module-path=/lib/syslogmod --pidfile=/var/run/syslogng_ser
10897 root     15520 S    /var/packages/SyslogServer/target/sbin/logdispatchd
10973 root     27608 S N  /usr/syno/sbin/synoindexd
10978 root     26520 S N  /usr/syno/bin/synomkthumbd
10983 root     26516 S N  /usr/syno/sbin/synomkflvd
11152 root     66776 S <  /var/packages/AudioStation/target/sbin/synoaudiod
11160 root     80332 S <  /var/packages/AudioStation/target/bin/pulseaudio
11187 root      9172 S <  /var/packages/AudioStation/target/sbin/synorcd
11482 root      9244 S N  /usr/syno/bin/photostationd
11710 root      1700 S    /var/packages/VPNCenter/target/sbin/pptpd -c /usr/syno/etc/packages/VPNCente
11721 root     54576 S    /var/packages/VPNCenter/target/sbin/vpnauthd
11820 root      6820 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon --cd /usr/syno/etc/pack
11821 root      6820 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon --cd /usr/syno/etc/pack
11828 root      6820 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon --cd /usr/syno/etc/pack
11964 root     59108 S    /var/packages/SurveillanceStation/target/sbin/sscored
11973 root     27288 S    /var/packages/SurveillanceStation/target/sbin/ssrotated
11977 root     27280 S <  /var/packages/SurveillanceStation/target/sbin/ssfindhostd
11986 root     61092 S    /var/packages/SurveillanceStation/target/sbin/vsctrld
11999 root     65456 S    /var/packages/SurveillanceStation/target/sbin/ssd -c 2
12162 root      9236 S N  /usr/syno/sbin/synologrotated
12294 root     64632 S    /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
12332 root      1588 S    /usr/syno/sbin/minissdpd -i eth0 -i tun0
16411 root     19572 S    sshd: root@pts/2
16426 root      4148 S    -ash
18511 nobody   64632 S    /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18512 nobody   64632 S    /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18513 nobody   64632 S    /usr/syno/apache/bin/httpd -DSSL -DHAVE_PHP
18640 root     13840 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
20762 root     13824 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
21070 root     13824 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
21198 root     13824 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
21284 root     13824 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
21531 root     13816 S    /usr/syno/apache/bin/httpd -DSSL -f /usr/syno/apache/conf/httpd.conf-sys
21660 root      4148 R    ps
24216 admin    34788 S    postgres: admin mediaserver [local] idle
24227 admin    34468 S    postgres: admin mediaserver [local] idle
Synology112>

[alexfs]

..quante risposte...

[BigOne]

io non ci capisco ancora gran che ....ma penso che tu sappia che pacchetti stai utilizzando e con quanti user stai collegato.
quindi se ti rileggi la lista processi e vedi user e processi extra o anomali,ci sei dentro.

e soprattutto te ne accorgi se ti segna la cpu 99%

io ero soggetto e con l aggiornamento mi e tornato tutto a posta e la cpu mi segna 1% ora

[alexfs]

ok grazie

farò come suggerisci....e terrò sotto controllo

ora ho imparato , come fare a visualizzare sia da visualizzotore attività,
che da riga di comando

grazie per avermi risposto

a volte per non sentirsi ..." soli a capire i problemi"
basta una risposta

saluti