Alguien podria ayudarme, ayer mi servidor fue desconectado por politicas de AUP, luego de enviar mi root passwd, me lo reconectaron y me dijeron que encontraron un nobody script named s:
"I have found a nobody script named s, that appears to have exploited httpd. I have disabled the httpd service and kill the script running in top. You may find our log files located in root under the ev1/ directory. If you have any questions on protecting your server, you may use http://forums.ev1servers.net/ for info.
Also found these vulnerable:
[00:37:29] Scanning GnuPG...
[00:37:29] /usr/bin/gpg found
[00:37:29] Version 1.0.7 seems to be vulnerable (if unpatched)!
[00:37:30] Scanning OpenSSL...
[00:37:30] /usr/bin/openssl found
[00:37:30] Version 0.9.6b seems to be vulnerable (if unpatched)!
"
10/15/2006 8:22:30 PM
NOC
Source ip: 66.xx.xxx.x
Dest ip: 85.186.103.65
0.0033 seconds ellapsed in capture
53030 inbound PPS to 85.186.103.65
0 outbound PPS from 85.186.103.65
24.14 inbound Mbps to 85.186.103.65
0.00 outbound Mbps from 85.186.103.65
1 2006-10-15 20:12:15.796896 66.xx.xxx.x -> 85.186.103.65 UDP Source port: 43611 Destination port: 80
2 2006-10-15 20:12:15.796899 66.xx.xxx.x -> 85.186.103.65 UDP Source port: 43611 Destination port: 80
3 2006-10-15 20:12:15.796900 66.xx.xxx.x -> 85.186.103.65 UDP Source port: 43611 Destination port: 80
4 2006-10-15 20:12:15.796901 66.xx.xxx.x -> 85.186.103.65 UDP Source port: 43611 Destination port: 80
5 2006-10-15 20:12:15.796902 66.xx.xxx.x -> 85.186.103.65 UDP Source port: 43611 Destination port: 80
A medianoche reconectaron el server, y hoy nuevamente ha pasado lo mismo han desconectado, alguien sabe como puedo solucionar esto, que deberia hacer una vez que me reconecten el server para protejerme de estos ataques masivos, como puedo identificar quien sube o como se generan estos scripts?
Agradezco la ayuda que me puedan brindar.