Installing OpenVPN 2.2 on Centos 5.7

OpenVPN is an SSL based VPN. There are other VPN solutions such as IPsec, etc. but OpenVPN provides a cost effective alternative. I like OpenVPN as it support two-way authentication, i.e. both the client and server authenticate using certificates. To install OpeVPN on CentOS we need a number of cryptographic libraries. The simplest way is to use the DAG/RPMForge repository.

Set-up the RPMForge repository [1], as this contains the packages necessary for the installation and the instructions are provided below. The instructions below are just to document this specific installation and therefore this blog post is not to be misinterpreted as a best practises guide. The instructions are adapted from the OpenVPN website [2], but this blog post is intended more as a quick and dirty guide to getting OpenVPN running on CentOS 5.7. Additionally the set-up and configuration of the client is considered beyond the scope of this blog post.

1. Install packages
1. rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
2. yum -y update
3. yum -y openvpn
2. Set-up configuration files
1. cd /etc/openvpn/
2. cp /usr/share/doc/openvpn-2.2.0/sample-config-files/server.conf .
3. mkdir -p /etc/openvpn/easy-rsa/keys
4. cd /etc/openvpn/easy-rsa
5. cp -rf /usr/share/doc/openvpn-2.2.0/easy-rsa/2.0/* .
6. chmod o+x,g+x clean-all, build-* vars whichopensslcnf pkitool inherit-inter list-crl revoke-full sign-req
3. Edit the PKI configuration
1. vi /etc/openvpn/easy-rsa/vars
1. Also consider setting the key length using KEY_SIZE variable, 1024 is the default 2048 is better, but slows down the TLS, but I am paranoid and use 4096 bit keys
2. Set the country (KEY_COUNTRY), state (KEY_PROVINCE), locality (KEY_CITY), organisation name (KEY_ORG), and support email (KEY_EMAIL)
4. Set-up the PKI infrastructure. This involves make a certificate authority and then generate the server certificate and any client machine certificates
1. Create the certificate authority
1. . ./vars
2. ./clean-all
3. ./build-ca
4. The CA key and certificate should not be in the keys directory inside the easy-rsa directory.
2. Create certificate for the server
1. ./build-key-server NAME_OF_SERVER
2. Answer the questions and commit the certificate into the database
3. Create the Diffie Hellman files
1. These files are used for the actual key exchange to ensure the confidentiality over an insecure channel, aka the Internet. Based on the length of the key used (KEY_SIZE) it may take a while.
2. ./build-dh
4. Create the certificate for each client
1. When doing this for clients, I generate one for each device a client may use, that way if a device is stolen or goes missing, I only have to revoke a single certificate and the others keep working as they do. Not sure if this a good approach, but its definitely my quick and dirty (lazy) approach.
2. ./build-key LAPTOP
3. ./build-key HOME-DESKTOP
4. ./build-key PDA
5. Edit the server configuration file 
1. vi /etc/openvpn/server.conf
2. Check/change
1. local
2. proto
3. dev
4. port
5. ca
6. cert
7. key
8. dh
9. max-clients
10. user
11. group
12. log-append
13. verb
6. Start everything
1. /etc/rc.d/init/openvpn start
2. chkconfig --level 235 openvpn on

Possible Errors:

1. If the OpenVPN server fails to start, ensure that logging is enabled, i.e. refer to log-append in the configuration file and examine the log. A common error is that OpenVPN fails to open certain files, check that the paths to these files are specified correctly.

References:

1. http://dag.wieers.com/rpm/FAQ.php
2. http://openvpn.net/howto.html

Installing OSSEC on Centos 5.7

OSSEC is an open source host-based IDS that performs log analysis, and is able to correlate and analyse logs for a number of Linux (and Windows, but that is outside the scope of this blog post) servers. The software architecture of OSSEC and the use of agents, lends OSSEC to flexible deployment and management [1].

Set-up the Atomic repository that already has the appropriate OSSEC packages and install them would be the easiest way. However I have a strong dislike for the use of the /var partition (most system administrators, hmm... well at-least I have always, set this up as a separate partition for ease of management and security reasons) as an install location, esp. when it has been specified as a "noexec" partition.

Please Note: 
Firstly, there are a number of dependencies of some of the set-up below, such as Apache, PHP, MySQL, but the installation and secure configuration of these services are beyond the scope of this blog post. Secondly, the configuration below is only to set-up OSSEC as a monitor and not run it in IPS, i.e. as an active response alert handler.

Installation using the repository

1. wget https://www.atomicorp.com/installers/atomic -O atomic.sh
2. . ./atomic.sh
3. yum -y update
4. yum -y install ossec-hids ossec-hids-server ossec-wui

Installation using the tar ball source

1. Download, compile and install the source
1. wget http://www.ossec.net/files/ossec-hids-2.6.tar.gz
2. tar zxvf ossec-hids-2.6.tar.gz
3. cd ossec-hids-2.6/src
4. make clean
5. make setdb
6. make all
7. cd ..
8. ./install.sh
1. en
2. local
3. /opt/ossec
4. y
5. user@domain
6. mx.domain
7. y
8. y
9. n
2. Setup mysql DB for logging
1. Grant access to database
1. mysql -u root -p
2. grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossecuser@localhost;
3. set password for ossecuser@localhost=PASSWORD('PASSWD');
4. quit;
2. Create database and tables
1. mysqladmin -u root -p create ossec
2. mysql -u root -p ossec < src/os_dbd/mysql.schema
3. Edit the /opt/ossec/etc/ossec.conf file
1. Check the wiki to setup logging to the database and syslog [2]
3. Install the Web User Interface, you will need Apache and php
1. Again, the installation and secure configuration of Apache is beyond the scope of this blog post. 
2. wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz
3. tar zxvf ossec-wui-0.3.tar.gz
4. mkdir -p /var/www/html/ossec-wui
5. cp -rf ./ossec-wui-0.3/* /var/www/html/ossec-wui/
6. cd /var/www/html/ossec-wui/
7. ./setup.sh
8. Edit the ossec_conf.php to point to the ossec installation completed in the previous stage
1. $ossec_dir="/opt/ossec";
4. Start the OSSEC services
1. /opt/ossec/bin/ossec-control enable database
2. /opt/ossec/bin/ossec-control enable client-syslog
3. /opt/ossec/bin/ossec-control start

Possible Errors:

1. When executing OSSEC-WUI you may get a page that displays. "Unable to access OSSEC directory". Ensure that the user that your Apache web server runs as, e.g. httpd or apache is added to the ossec group
1. usermod -a -G ossec apache.
2. "Unable to retrieve alerts". Ensure that you web server is able to open the alerts file. This issue is two fold, firstly ensure that the web server has permissions to open the file and secondly that the fopen command is enabled in PHP.
1. safe_mode Off
2. safe_mode_gid On
3. These two are no so much error, but warning that will be annoy your syslog server, but depend on your PHP configuration.
1. PHP Warning:  shell_exec() has been disabled for security reasons - This is because of a uname -a query in the /var/www/html/ossec-wui/lib/os_lib_agent.php script;
1. //$agent_list[$agent_count]{'os'} = `uname -a`;
2. $agent_list[$agent_count]{'os'} = "Linux";
2. PHP Warning:  fseek() expects parameter 3 to be long - This may be a simple programming error in the /var/www/html/ossec-wui/lib/os_lib_alerts.php
1. //fseek($fp, $seek_place, "SEEK_SET");
2. fseek($fp, $seek_place );

References:

1. http://en.wikipedia.org/wiki/OSSEC
2. http://www.ossec.net/wiki

Installing Snort 2.9.1.2 on CentOS 5.7

CentOS 5.7 uses an older version of libpcap (0.9.4), but Snort's Data Acquisition Library (daq) needs a newer version of libpcap (>=1.0.0). The latter is not an issue with the CentOS 6.0. Vishesh Kumar [1] provides an excellent instructions to getting Snort 2.9 to run on RHEL 5 (http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html). The purpose of this post is not to duplicate his efforts, but to extend it slightly to include instructions for a complete Snort set-up.

1. libpcap - http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz [3]
2. daq : http://www.snort.org/downloads/1221 [2]
3. snort : http://www.snort.org/downloads/1207 [2]

Download and install the libraries and software as per the instructions below;

1. Enable the Extra Packaged for Enterprise Linux (EPEL) repository to enable the installation of additional packages not available under the standard repositories
1. rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
2. yum -y update
3. yum -y upgrade
2. Install developments to compile the libraries and source code, and additional libraries and header files that are required later on
1. yum -y groupinstall 'Development Tools'
2. yum -y install pcre-devel
3. yum -y install libdnet-devel
4. yum -y install zlib-devel
5. yum -y install mysql mysql-server mysql-devel mysql-bench
3. Download, compile and install libpcap
1. wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
2. cd libpcap-1.1.1
3. ./configure --prefix=/usr
4. make && make install
4. Download, compile and install daq
1. wget http://www.snort.org/downloads/1221 -O daq-0.6.2.tar.gz
2. cd daq-0.6.2
3. ./configure
4. make && make install
5. Download, compile and install snort
1. wget http://www.snort.org/downloads/1207 -O snort-2.9.1.2.tar.gz
2. cd snort-2.9.1.2
3. ./configure --with-mysql
4. make && make install
6. Download, compile and install Barnyard2
1. wget --no-check-certificate https://github.com/firnsy/barnyard2/tarball/master -O firnsy-barnyard2-405761e.tar.gz
2. tar zxvf firnsy-barnyard2-405761e.tar.gz
3. cd firnsy-barnyard2-405761e
4. ./autogen.sh
5. ./configure --with-mysql
6. make && make install
7. Create the snort database on the mysql enginer
1. mysqladmin -u root -p create snort
2. mysql -u root -p -D snort < schemas/create_mysql
3. mysql -u root -p
1. GRANT CREATE,INSERT ON root.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
2. GRANT CREATE,INSERT,SELECT,DELETE,UPDATE ON snort.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
8. To get the current registered user rules, you need to sign up and obtain an Oinkcode. The Oinkcode will be used for downloading the rules and used with pulledpork.
1. Sign in or request an account from https://www.snort.org/login
2. Get your oinkcode after signing in from https://www.snort.org/account/oinkcode
3. cd etc
4. wget http://www.snort.org/reg-rules/snortrules-snapshot-.tar.gz/OINKCODE -O snortrules-snapshot-LATEST.tar.gz
5. tar zxvf snortrules-snapshot-LATEST.tar.gz
9. Setup the configuration and rules files for snort
1. mkdir -p /etc/snort
2. mv -f etc/* .
3. rmdir etc/
4. mv snortrules-snapshot-LATEST.tar.gz ../../
5. rm -f Makefile Makefile.am Makefile.in
6. cp -rf * /etc/snort/
10. Edit the snort configuration
1. vi /etc/snort/snort.conf
1. ipvar HOME_NET
2. var RULE_PATH rules
3. var SO_RULE_PATH so_rules
4. var PREPROC_RULE_PATH preproc_rules
5. output database: log, mysql, user=snort password=PASSWORD dbname=snort host=localhost
6. output alert_syslog: LOG_LOCAL6 LOG_ALERT
11. Edit the syslog.conf file to log alerts to separate file and restart the syslog daemon
1. Include the line in syslog.conf "local6.*        /var/log/snort/alerts.log"
2. /etc/rc.d/init.d/syslog restart
12. Test the snort installation, and set-up environment to run snort if all OK
1. snort -c /etc/snort/snort.conf -T
2. useradd -G snort snort -s /bin/false
3. chown -R root:snort /var/log/snort
4. chmod -R g+w /var/log/snort
13. Configure barnyard [4]
1. mkdir -p /var/log/barnyard2
2. chmod 666 /var/log/barnyard2
3. touch /var/log/snort/barnyard2.waldo
4. cp etc/barnyard2.conf /etc/snort/
5. Edit the /etc/snort/barnyard2.conf
1. output database: log, mysql, user=snort password= dbname=snort host=localhost
2. config hostname:   localhost
3. config interface:  eth0
14. You can get snort to start automatically, but writing a customer script to start/stop/restart the daemon or simply kicking it off to start up when the machine boots. Edit the rc.local file and out the following in
1. /usr/local/bin/snort -D -u snort -g snort -c /etc/snort/snort.conf -i eth0
2. /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D

Common Errors:

1. ERROR: parser.c(5261) Could not stat dynamic module path "/usr/local/lib/snort_dynamicrules": No such file or directory.
   Fatal Error, Quitting..
1. mkdir -p /usr/local/lib/snort_dynamicrules
2. cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/
2. ERROR: /etc/snort/rules/web-misc.rules(555) Cannot use the fast_pattern content modifier for a lone http cookie/http raw uri /http raw header /http raw cookie /status code / status msg /http method buffer content.
   Fatal Error, Quitting..
1. The fast_pattern option cannot be used with the http_method string. Edit the web-misc.rules file and remove it from the snort rule. Do a search for "2010-0388" and remove the alert option fast_pattern from the alert rule.
3. ERROR: /etc/snort/snort.conf(244) => 'compress_depth' and 'decompress_depth' should be set to max in the default policy to enable 'unlimited_decompress'
   Fatal Error, Quitting..
1. Edit the /etc/snort/snort.conf file and set the http_inspect compress_depth and decompress_depth to 65535 from 20480.
4. ERROR: ByteExtract variable 'bugtraq' in rule [3:13897] is used before it is defined
1. Ensure that the shared libraries copied above using "cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/" are for the correct distribution
2. Ensure that the rules being used are for the version of snort being used.

Please note: 

1. These instruction are for 32bit hardware, for 64bit machines you will need to select appropriate 64bit RPM packages or configure and compile with appropriate compiler switches. These are considered beyond the scope of this post.
2. All instructions are executed with root privileges.

References:

1. http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html
2. http://www.snort.org/snort-downloads?
3. http://www.tcpdump.org/#latest-release
4. http://www.snort.org/assets/145/Install_Snort_2.8.6_on_CentOS_5.5.pdf

Gnu Screen

Running some experiment on a VM server I rapidly ran out of patience having to wait for commands to run, and/or switching back and forth using Ctrl+Z, bg, and fg. My thoughts went back to Nick Black who had introduced me to Gnu Screen several years back, alas I has forgotten the short-cuts, Thankfully Google and the man page came to the rescue.

Since the VM server was a CentOS 6.0 box, with minimal install, I had to install Gnu Screen using;

1. yum -y install screen

Here's a summary of the shortcuts that may be useful;

• Ctrl+A, c : create a new screen
• Ctrl+A, A : set a name for the screen instead of the default shell name (bash)
• Ctrl+A, " : lists the screens available
• Ctrl+A, n : toggle to next screen
• Ctrl+A, p : toggle to previous screen

References:

1. http://www.gnu.org/s/screen/

APAcite on Mac OS X (Lion) with texlive

I had to recently rebuild my Mac Book Pro (gasp!), and decided to upgrade to Lion.  The whole process was relatively painless. Files were copied back from backups, and updated from my SVN repositories, however I had troubles installing the appropriate Mac port package for the APACite classes.

sudo port install texlive-bibtex-extra

The latter yielded errors, which were logged in

/opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/main.log

Since the dependency p5.12-text-bibtex could not be installed, examination of the log file provided the following clues; error: 'main' must return 'int'

The same error was reported for;

1. /opt/local//var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/work/Text-BibTeX-0.60/btparse/tests/namebug.c
2. /opt/local//var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/work/Text-BibTeX-0.60/btparse/tests/tex_test.c

A quick rename of void to int enabled the package to be installed without further issues.

APAcite on Mac OS X with texlive

While compiling a LaTeX document, a blank template of my PhD thesis to be exact, when I got the following error "! LaTeX Error: File `apacite.sty' not found." Again a quick search for Mac ports indicated that the texlive-bibtex-extra package was required. It was quickly installed using;

sudo port install texlive-bibtex-extra

Subsequent compile yielded more errors, this time it was "! Undefined control sequence. \abstract". This was solved using the texlive-latex-extra package, installed using;

sudo port install texlive-latex-extra


Then adding the following to define the abstract in the book documentclass;

% Define abstract in book documentclass
\pagestyle{empty}
\newenvironment{abstract}%
{
  \onehalfspacing%
  \null
  \vfill
  \chapter*{\centering Abstract}%
  \addcontentsline{toc}{chapter}{Abstract}
}%
{\vfill\null}

% Start the actual abstract
\begin{abstract}
\end{abstract}

More errors resulted "! Use of \@year@ doesn't match its definition." I had to add "\bibliographystyle{apacite}" to the bibligraphy page, and all was well once again.

References:

1. https://trac.macports.org/wiki/TeXLivePackages
2. http://www.cs.utexas.edu/~witchel/errorclasses.html

Evernote and Nix/NeverNote on Ubuntu 10.04

Evernote is a great tool. I absolutely love it. The only con, is that it's nto available natively for Linux. So I have to run it under the Windows Emulator or wine. The installation is fairly simple.

1. wget http://evernote.s3.amazonaws.com/win4/public/Evernote_4.5.0.5229.exe
2. wine Evernote_4.5.0.5229.exe

Obviously not running natively there is a slight performance lag. This may be attributed to my 5 year old laptop. Although it's still usable, the slow synchronization soon becomes tiresome. Fortunately there is a Linux native client called NeverNote[2].

1. sudo add-apt-repository ppa:vincent-c/nevernote
2. sudo apt-get update
3. sudo apt-get install nevernote
4. nixnote

NixNote is a bit ugly, but functional. Definitely faster than running Evernote in emulation.  The feature that I like best is that you are able to encrypt the NixNote database using AES when you shutdown. This is a definite plus in my books.

Therefore, if you can live with the degraded performance, then Evernote will do, but if you need to work faster, want that extra bit of security, and an ugly interface does not bother you, then give NixNote (aka NeverNote) a try.

References:

1. http://www.howtogeek.com/howto/35661/how-to-install-evernote-4.0-in-ubuntu-using-wine/
2. http://www.techdrivein.com/2011/06/nevernote-open-source-evernote-clone.html

Cisco console from Ubuntu 10.04

It's pretty easy to set-up Cisco serial console connectivity on Ubuntu 10.04. The usual way is to use minicom. The serial ports usually called COM1-4 usually have the following address range;

1. COM1 - 3E8
2. COM2 - 2F8
3. COM3 - 3E8
4. COM4 - 2E8

To complete the setup first determine the address used for COM1 (or whichever serial port you wish to use) on your machine  query the kernel buffer ring using the dmesg command, then install and configure the minicom, modem emulation tool.

1. sudo dmesg | grep tty
2. sudo apt-get install minicom
3. sudo minicom -s # Configure the terminal to use 9600-8-N-1 and save as dfl
4. sudo minicom

References:

1. https://help.ubuntu.com/community/CiscoConsole
2. http://useopensource.blogspot.com/2007/01/using-cisco-console-in-linux.html

KeePass on Ubuntu 10.04

KeePass is a very popular password management software. One of my client uses this for their systems and I was given a copy of their database. Since I mostly use linux when I am working, I needed a way to get this working on Ubuntu 10.04. Instructions are widely available, but again for my benefit, I have documented them here as step-by-step guide for myself. At the time of this blog post the 2.x version of KeePass was 2.16

Firstly install Mono. For more details refer to the Badger ports website[1].

1. Edit the /etc/apt/sources.list file
• Add the lines
• # For mono 2.6 -> needed by KeePass
• deb http://badgerports.org lucid main
2. cd /etc/apt
3. sudo wget http://badgerports.org/directhex.ppa.asc
4. sudo apt-key add directhex.ppa.asc
5. sudo apt-get update
6. sudo apt-get install mono mono-devel
7. mono --version
• # Confirm the mono version is >= 2.6

Download and install the KeePass from the KeePass website[2].

1. sudo mkdir -p /opt/KeePass2
2. cd /opt/KeePass2
3. wget http://downloads.sourceforge.net/keepass/KeePass-2.16.zip
4. sudo unzip KeePass-2.16.zip

Execute the KeePass application

1. mono /opt/KeePass2/KeePass.exe &

There does appear to be a lot of debug information (am assuming its debug information) written to the terminal, but these should be safe to ignore.

References:

1. http://badgerports.org
2. http://keepass.info

SPAM - Westpac Notice

I recently got an email with the subject "[Bulk] Westpac Notice" claiming to be from "notice@westpac.com.au". I knew this was SPAM, but was curious none the less, I felt like investigating further, but didn't have much time... my curiosity got the better of me, and I decided to do some quick digging anyway.

The link on the email resolved to "http://www.backrite.com/cw3/assets/product_small/Westpac.com.au/Westpac/index.htm", I very crude attempt I thought, the least they could have done was attempt to get a domain that at least appears slightly legitimate or use a URL shortening service at least.

I fired up my debuggig VM and opened up Firefox and pasted the URL in, the site appeared to be down. This was going to be quicker than I thought. Next I examined the e-mail headers and found a number of interesting things;


iX-Apparently-To: me@me.com via 76.13.9.102; Mon, 12 Sep 2011 17:35:43 -0700
X-YahooFilteredBulk: 72.52.199.90
Received-SPF: none (domain of server22.01domain.net does not designate permitted sender hosts)
X-YMailISG: uqaL3oQWLDupZk39g7NZ_d1X.jvu2AiRfqDcSAS5WI1yggQj
 qKsr_wBhJ6fOB576uyrk3sOva0uAvBRbH2D9buWQ2RMJpgB.gBvrBbexkVVz
 XhkFvqbM2oAMn_GHLmNEOUb_wcs6rU031UCGN0Gc8InmvAhB8wE6ua0shbqw
 gqobfvaLzFTrjLeJ03BlqKdv3L_RDh4xyyLL2saipKDl7XkbKwLizqsr4c6R
X-Originating-IP: [72.52.199.90]
Authentication-Results: mail.me.com  from=westpac.com.au; domainkeys=neutral (no sig);  from=westpac.com.au; dkim=neutral (no sig)
Received: from 127.0.0.1  (EHLO server22.01domain.net) (72.52.199.90)
  by mail.me.com with SMTP; Mon, 12 Sep 2011 17:35:42 -0700
Received: from nobody by server22.01domain.net with local (Exim 4.69)
(envelope-from )
id 1R3GyS-0001kr-68
for me@me.com; Mon, 12 Sep 2011 20:35:40 -0400
To: me@me.com
Subject: [Bulk] Westpac Notice
X-PHP-Script: proteinat.com/store/images/tmp/z.php for 41.184.112.91
From:  
Reply-To: 
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Mon, 12 Sep 2011 20:35:40 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server22.01domain.net
X-AntiAbuse: Original Domain - me.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server22.01domain.net

Firstly, the originating IP did not match the server in the URL. Next the X-PHP-Script header gave an interesting clue, a copy and paste revealed another downed script, but this time the response from the server was more promising, a quick fuzz and I found "http://proteinat.com/store/images/cookie_load.php"

Which is a PHP shell called Web Shell by oRb or WSO. The running version was 2.5 which was released in June of 2011. The attacker must have exploited PHP and uploaded the file. The PHP shell allows for a console which is useful for work, e.g. creating a backdoor, as well as running exploits to escalate privileges to get root access. I have not had the chance to investigate further, but it would be interesting to determine how the hacker got in in the first place.