Re: Centos 5.3 -> Apache - Under Attack ? Oh hell....

[Drew <drew.kay@xxxxxxxxx>]

> Further googling indicates that UnixCod  is a brute force ssh scanner... what is is odd is that i have fail2ban ruunning ( which blocks IPs after 2 failed attempts) and a 8 letter passwd but i still got hacked....
Hi Marco,
Just because the app is an SSH scanner doesn't automatically mean theybroke in through SSH.
As has been mentioned a few times the most likely vector ofattack/compromise on your machine was through a app/script of somesort running on your website. Any of the app's you mentioned in anearlier post is suspect in this case.

-- Drew
"Nothing in life is to be feared. It is only to be understood."--Marie Curie_______________________________________________CentOS mailing listCentOS@xxxxxxxxxxxxxx://lists.centos.org/mailman/listinfo/centos