# Suspicious connections on ES **URL:** \ **Category:** Elasticsearch\ **Created:** [April 22, 2015, 10:16am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358 "2015-04-22T10:16:15Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jason\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_zhang/32/745_2.png) [@Jason\_Zhang](https://discuss.elastic.co/u/Jason_Zhang)\ **Post date:** [April 22, 2015, 10:16am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/1 "2015-04-22T10:16:15Z")
Hi, Recently I find something odd using lsof: ```auto $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq freeBSD my_ip:random_port->unknown_ip:port Intelnets my_ip:random_port->unknown_ip:port .lz142958 my_ip:random_port->unknown_ip:port service (ESTABLISHED) sh (ESTABLISHED) xudp my_ip:random_port->unknown_ip:port zlwanby my_ip:random_port->unknown_ip:port ``` I've configured iptables to allow my ips to connect. Why can those foreign ip still connect to my ES? I use ES v1.3.9. Thanks in advance. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8f8b3f05-5294-4330-81d2-2e98370caf39%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8f8b3f05-5294-4330-81d2-2e98370caf39%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Jason\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_zhang/32/745_2.png) [@Jason\_Zhang](https://discuss.elastic.co/u/Jason_Zhang)\ **Post date:** [April 22, 2015, 10:44am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/2 "2015-04-22T10:44:10Z")
Also, I've noticed there're many suspicious files in /tmp, like: ```auto $ ls -al /tmp 26000 32 991linux conf.n elasticsearch/ gates.lock git icp Intelip Intelips Intelnet Intelnets jrtj log .lz1429583673 xudp xx32 zlwanby ``` Is my machine be hacked? On Wednesday, April 22, 2015 at 6:16:15 PM UTC+8, Jason Zhang wrote: > Hi, > > Recently I find something odd using lsof: > > ```auto > $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq > freeBSD my_ip:random_port->unknown_ip:port > Intelnets my_ip:random_port->unknown_ip:port > .lz142958 my_ip:random_port->unknown_ip:port > service (ESTABLISHED) > sh (ESTABLISHED) > xudp my_ip:random_port->unknown_ip:port > zlwanby my_ip:random_port->unknown_ip:port > > ``` > > I've configured iptables to allow my ips to connect. > Why can those foreign ip still connect to my ES? > > I use ES v1.3.9. > > Thanks in advance. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 23, 2015, 12:57am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/3 "2015-04-23T00:57:35Z")
Is your ES instance open to the world? Check your ES logs as well. On 22/04/2015 8:44 pm, "Jason Zhang" [mock2u@gmail.com](mailto:mock2u@gmail.com) wrote: > Also, I've noticed there're many suspicious files in /tmp, like: > > ```auto > $ ls -al /tmp > 26000 > 32 > 991linux > conf.n > elasticsearch/ > gates.lock > git > icp > Intelip > Intelips > Intelnet > Intelnets > jrtj > log > .lz1429583673 > xudp > xx32 > zlwanby > > ``` > > Is my machine be hacked? > > On Wednesday, April 22, 2015 at 6:16:15 PM UTC+8, Jason Zhang wrote: > > > Hi, > > > > Recently I find something odd using lsof: > > > > ```auto > > $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq > > freeBSD my_ip:random_port->unknown_ip:port > > Intelnets my_ip:random_port->unknown_ip:port > > .lz142958 my_ip:random_port->unknown_ip:port > > service (ESTABLISHED) > > sh (ESTABLISHED) > > xudp my_ip:random_port->unknown_ip:port > > zlwanby my_ip:random_port->unknown_ip:port > > > > ``` > > > > I've configured iptables to allow my ips to connect. > > Why can those foreign ip still connect to my ES? > > > > I use ES v1.3.9. > > > > Thanks in advance. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X\_Bt%3DsPX\_ZZ%3DgpqPQrJbieby4g2M8fK-hqYs4RkTrxmew%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X_Bt%3DsPX_ZZ%3DgpqPQrJbieby4g2M8fK-hqYs4RkTrxmew%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Jason\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_zhang/32/745_2.png) [@Jason\_Zhang](https://discuss.elastic.co/u/Jason_Zhang)\ **Post date:** [April 23, 2015, 1:46am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/4 "2015-04-23T01:46:27Z")
Yes, but I've configured iptables to avoid those foreign unknown connections like: ```auto $ sudo iptables -I INPUT -p tcp -s my_ip --dport 9200:9400 -j ACCEPT $ sudo iptables -P INPUT -j DROP ``` I forgot to say that I set `script.disable_dynamic: false` to run some external js scripts. At that time, ES was still v1.3.7. On Thursday, April 23, 2015 at 8:57:42 AM UTC+8, Mark Walkom wrote: > Is your ES instance open to the world? > Check your ES logs as well. > On 22/04/2015 8:44 pm, "Jason Zhang" \<[moc...@gmail.com](mailto:moc...@gmail.com) \\> > wrote: > > > Also, I've noticed there're many suspicious files in /tmp, like: > > > > ```auto > > $ ls -al /tmp > > 26000 > > 32 > > 991linux > > conf.n > > elasticsearch/ > > gates.lock > > git > > icp > > Intelip > > Intelips > > Intelnet > > Intelnets > > jrtj > > log > > .lz1429583673 > > xudp > > xx32 > > zlwanby > > > > ``` > > > > Is my machine be hacked? > > > > On Wednesday, April 22, 2015 at 6:16:15 PM UTC+8, Jason Zhang wrote: > > > > > Hi, > > > > > > Recently I find something odd using lsof: > > > > > > ```auto > > > $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq > > > freeBSD my_ip:random_port->unknown_ip:port > > > Intelnets my_ip:random_port->unknown_ip:port > > > .lz142958 my_ip:random_port->unknown_ip:port > > > service (ESTABLISHED) > > > sh (ESTABLISHED) > > > xudp my_ip:random_port->unknown_ip:port > > > zlwanby my_ip:random_port->unknown_ip:port > > > > > > ``` > > > > > > I've configured iptables to allow my ips to connect. > > > Why can those foreign ip still connect to my ES? > > > > > > I use ES v1.3.9. > > > > > > Thanks in advance. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 23, 2015, 3:49am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/5 "2015-04-23T03:49:51Z")
It looks like your instance has been breached. You may want to take a look at > **[Scripting and Security](https://www.elastic.co/blog/scripting-security/)** On 23 April 2015 at 11:46, Jason Zhang [mock2u@gmail.com](mailto:mock2u@gmail.com) wrote: > Yes, but I've configured iptables to avoid those foreign unknown > connections like: > > ```auto > $ sudo iptables -I INPUT -p tcp -s my_ip --dport 9200:9400 -j ACCEPT > $ sudo iptables -P INPUT -j DROP > > ``` > > I forgot to say that I set `script.disable_dynamic: false` to run some > external js scripts. > At that time, ES was still v1.3.7. > > On Thursday, April 23, 2015 at 8:57:42 AM UTC+8, Mark Walkom wrote: > > > Is your ES instance open to the world? > > Check your ES logs as well. > > On 22/04/2015 8:44 pm, "Jason Zhang" [moc...@gmail.com](mailto:moc...@gmail.com) wrote: > > > > > Also, I've noticed there're many suspicious files in /tmp, like: > > > > > > ```auto > > > $ ls -al /tmp > > > 26000 > > > 32 > > > 991linux > > > conf.n > > > elasticsearch/ > > > gates.lock > > > git > > > icp > > > Intelip > > > Intelips > > > Intelnet > > > Intelnets > > > jrtj > > > log > > > .lz1429583673 > > > xudp > > > xx32 > > > zlwanby > > > > > > ``` > > > > > > Is my machine be hacked? > > > > > > On Wednesday, April 22, 2015 at 6:16:15 PM UTC+8, Jason Zhang wrote: > > > > > > > Hi, > > > > > > > > Recently I find something odd using lsof: > > > > > > > > ```auto > > > > $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq > > > > freeBSD my_ip:random_port->unknown_ip:port > > > > Intelnets my_ip:random_port->unknown_ip:port > > > > .lz142958 my_ip:random_port->unknown_ip:port > > > > service (ESTABLISHED) > > > > sh (ESTABLISHED) > > > > xudp my_ip:random_port->unknown_ip:port > > > > zlwanby my_ip:random_port->unknown_ip:port > > > > > > > > ``` > > > > > > > > I've configured iptables to allow my ips to connect. > > > > Why can those foreign ip still connect to my ES? > > > > > > > > I use ES v1.3.9. > > > > > > > > Thanks in advance. > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > To view this discussion on the web visit > > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com) > > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9OmrDLU6BdpP5k0Arh4Thcn65bMWb7RN%2B3Yq%3DowD9KLw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9OmrDLU6BdpP5k0Arh4Thcn65bMWb7RN%2B3Yq%3DowD9KLw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Jason\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_zhang/32/745_2.png) [@Jason\_Zhang](https://discuss.elastic.co/u/Jason_Zhang)\ **Post date:** [April 23, 2015, 4:12am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/6 "2015-04-23T04:12:45Z")
Yes, and those processes continue to ddos other ips... I've stopped those processes and delete the binary files. Also, disable the dynamic scripting. On Thursday, April 23, 2015 at 11:50:19 AM UTC+8, Mark Walkom wrote: > It looks like your instance has been breached. > > You may want to take a look at > [Scripting and Security | Elastic Blog](https://www.elastic.co/blog/scripting-security/) > > On 23 April 2015 at 11:46, Jason Zhang \<[moc...@gmail.com](mailto:moc...@gmail.com) \\> > wrote: > > > Yes, but I've configured iptables to avoid those foreign unknown > > connections like: > > > > ```auto > > $ sudo iptables -I INPUT -p tcp -s my_ip --dport 9200:9400 -j ACCEPT > > $ sudo iptables -P INPUT -j DROP > > > > ``` > > > > I forgot to say that I set `script.disable_dynamic: false` to run some > > external js scripts. > > At that time, ES was still v1.3.7. > > > > On Thursday, April 23, 2015 at 8:57:42 AM UTC+8, Mark Walkom wrote: > > > > > Is your ES instance open to the world? > > > Check your ES logs as well. > > > On 22/04/2015 8:44 pm, "Jason Zhang" [moc...@gmail.com](mailto:moc...@gmail.com) wrote: > > > > > > > Also, I've noticed there're many suspicious files in /tmp, like: > > > > > > > > ```auto > > > > $ ls -al /tmp > > > > 26000 > > > > 32 > > > > 991linux > > > > conf.n > > > > elasticsearch/ > > > > gates.lock > > > > git > > > > icp > > > > Intelip > > > > Intelips > > > > Intelnet > > > > Intelnets > > > > jrtj > > > > log > > > > .lz1429583673 > > > > xudp > > > > xx32 > > > > zlwanby > > > > > > > > ``` > > > > > > > > Is my machine be hacked? > > > > > > > > On Wednesday, April 22, 2015 at 6:16:15 PM UTC+8, Jason Zhang wrote: > > > > > > > > > Hi, > > > > > > > > > > Recently I find something odd using lsof: > > > > > > > > > > ```auto > > > > > $ sudo lsof -p pid | grep -i tcp | awk '{print $1, $10}' | sort | uniq > > > > > freeBSD my_ip:random_port->unknown_ip:port > > > > > Intelnets my_ip:random_port->unknown_ip:port > > > > > .lz142958 my_ip:random_port->unknown_ip:port > > > > > service (ESTABLISHED) > > > > > sh (ESTABLISHED) > > > > > xudp my_ip:random_port->unknown_ip:port > > > > > zlwanby my_ip:random_port->unknown_ip:port > > > > > > > > > > ``` > > > > > > > > > > I've configured iptables to allow my ips to connect. > > > > > Why can those foreign ip still connect to my ES? > > > > > > > > > > I use ES v1.3.9. > > > > > > > > > > Thanks in advance. > > > > > > > > -- > > > > You received this message because you are subscribed to the Google > > > > Groups "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > To view this discussion on the web visit > > > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com) > > > > [https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4dd30173-a043-4dc4-b71a-1732d5860640%40googlegroups.com?utm_medium=email&utm_source=footer) > > > > . > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > > > -- > > > You received this message because you are subscribed to the Google Groups > > > "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send an > > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > > To view this discussion on the web visit > > > [https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com) > > > [https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/95cf0055-b274-4164-8330-16b6498e834d%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/738c1f34-4954-428b-b9a7-f5d78d32160d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/738c1f34-4954-428b-b9a7-f5d78d32160d%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:18am UTC](https://discuss.elastic.co/t/suspicious-connections-on-es/23358/7 "2017-07-06T00:18:09Z")