How to protect the server from the shell?

Question

linux

Hi everyone, I've got an unfortunate situation. A man uploaded a file through FTP manager and started doing a dos attack. Please tell me how to cover this hole? Panel: isp manager

Answer 1

The attack is launched after uploading the file via HTTP (how else?). Find a file in an ftp folder using the find utility by creation/modification time, kill it. Check process list, check outgoing connections (especially irc). Make sure the script doesn't restart itself with another process. For the future, separate the folder with scripts that can be run and the ftp folder.