Continuous issues with the cron jobs.

[infolearn]

Hello to all.

We currently have a Managed Dedicated CentOS server.

The last month we keep facing the same error. Our cron jobs get deleted for an unknown reason.

The support department seems to be unable to resolve this issue, so we thought to give it a shot from here.

First time, it happened on January 2nd. Until to days it has happened a couple more times, and so did today.

About 16:51 - 16:52 server time, we noticed that the cron jobs were not running. We logged in into PLESK and saw that all of the jobs disappeared. Again.
The next thing we did, was to login through SSH. When we logged in, we did not see the message we always do: "last login from <time and address here>". That's suspicious.
Immediately we execute history and see that the command history is empty. It shouldn't be.

Once again, we created the jobs but noticed that they did not run, although PLESK said they did. So, we restarted the crond service, and the jobs began to run.

Does anyone have any clue at all to what might be the issue? We are getting really frustrated here. We cannot be over the sever day and night watching if the jobs are running or not.

Regards,
infolearn

[eUK-Patrick]

I have replied your ticket in detail along with the logs . Please go through it and let us know if you need any further clarification on the ongoing problem with your cron jobs.

[infolearn]

In your reply, you mentioned that we should not have created the cron jobs under the root user, and that was the reason why the jobs got resetted. We followed your advice, and switched them.

But if this is the case, how is it possible for the cron jobs to work properly all this time?
And one second thing, how is the history clean-up explained? (and the "last login" message as well). How it this related at all?

Regards,
infolearn

[eUK-Patrick]

I have provided few more logs related to SSH access in the same ticket .Please check and let us know if you are satisfied with the answer or you still have any further questions.

[infolearn]

From your last support reply we see that only the support department or us (infolearn) have been connected through SSH, but still, somehow the logs got deleted and the cron jobs resetted.

How is this even possible? Can we scan our system or something?

Regards,
infolearn

[infolearn]

eukhost's support is getting worse and worse in the last 2 months

i hope some senior staff member will read this

[THOMAS-UK]

Hello,

Did you receive the last reply to your ticket with us? It was sent on the 28th of January and we haven't received a response since. I'll forward you the reply once more to be sure. Should anything be unclear or if you have sent a reply on it which the system might have missed, please do let us know.

[Rsync]

Hello,

I have checked your server and the SSH login is not restricted to you and us only, it's been allowed to everyone as there is no restriction rule. Login logs shows that our admin logged into the server after you had initiated the chat and our support admin did not delete anything from the server without your confirmation. We only login to your server when you request us to check the issues.
I will suggest you to restrict the root access to your IP address only and when its necessary for us to login we will ask you to allow the access to that we can investigate on the issue.
Also, it's not possible that cron get deleted automatically direct from the server.
PM me your static IP address and I will make the necessary changes and the restrict the login to your IP address only.
Also I have PM you the the details last login records of ssh please go through it once.

[infolearn]

After the first incident while talking with you through live chat we asked for you to change the SSH port to something else other than 22, install a firewall and to restrict all access (SSH and FTP) to a specific IP address.

We guess that wasn't done (although the port change and firewall installation were done), because through the SSH logs you sent us, we can see that our system has been compromised through a specific IP address originating in Russia.

We are currently taking backups and preparing for a fresh OS installation as Thomas suggested.