[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: we were attacked



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

danilo lujambio on Friday 07 Apr 2006 20:19 wrote:

> Hi,
> 
> in one of our servers with Sarge we are suffering an attack wich put a
> perl script and two executables in /tmp with owner www-data.
> We couldn't find any data in messages , syslog, apache.log which help
> us. We have a shorewall with very few ports open (ssh , ftp and web) .
> Can someone help us in how to looking for the source of the attack ?
> 
> thanks in advance
> 
> d.l.

Does your server run awstats or phpbb ??

Ritesh
- -- 
Ritesh Raj Sarraf
RESEARCHUT -- http://www.researchut.com
"Necessity is the mother of invention."
"Stealing logic from one person is plagiarism, stealing from many is
research."
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEN3J24Rhi6gTxMLwRAtXrAJ4+erqe4ePvyT6oUyEvUoJXrSQXLgCeLMo/
zIkgLlM8C7IQCx6K9xdZI3U=
=iVTd
-----END PGP SIGNATURE-----



Reply to: