How to protect the server from the shell?

V

vaniqq2017-03-10 22:15:20

linux

vaniqq, 2017-03-10 22:15:20

Hi everyone, I've got an unfortunate situation. A man uploaded a file through FTP manager and started doing a dos attack. Please tell me how to cover this hole? Panel: isp manager

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

E

Eugene Khrustalev, 2017-03-11
@eugenehr

The attack is launched after uploading the file via HTTP (how else?). Find a file in an ftp folder using the find utility by creation/modification time, kill it. Check process list, check outgoing connections (especially irc). Make sure the script doesn't restart itself with another process. For the future, separate the folder with scripts that can be run and the ftp folder.