Email system faults caused by scheduled tasks

After receiving a friend's call for help, he said that sending and receiving emails was very slow, and the email server was also very slow to log on to. after asking about the network conditions and hardware problems, he tried to log on to the system and check the system. It was so slow that the prompt for entering the password never appeared. after about a minute, the... information & nbs

After receiving a friend's call for help, he said that sending and receiving emails was very slow, and the email server was also very slow to log on to. after asking about the network conditions and hardware problems, he tried to log on to the system and check the system.
It was so slow that the prompt for entering the password never appeared. after about a minute, the long-overdue cursor finally gave up! Okay. enter the password and log on. The command line interface is also slow!

First, check the CPU usage. top capital key. open input P.
Strange! How can a chmod process always exist? Normally, you do not need to change the file permission all the time. is it hacked?

Check the system process.
Ps aux | grep chmod my day! It turns out that the folder permission under the user's mailbox directory has been being executed to change the chmod 777/home/mailbox/* command

After thinking about it, this command should be executed very quickly and should not always exist. there are only two reasons for this. One is that some people are always executing this command, I don't think that hacker has such patience. you are persistent enough. one is a cron task.
This is true for crontab-l. you can see the figure!

In this case, the system is constantly executing this task, and it is strange that the system is not slow.

Kill it !! Killall chmod

Delete this scheduled task!
System Recovery
 

This article is from the "Shadow Knight" blog