LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-06-2005, 06:58 PM   #1
Jek
LQ Newbie
 
Registered: Feb 2004
Posts: 18

Rep: Reputation: 0
Logs ?


Hi all,

I have been running a fedora C2 webserver at home for a while just to host some family photos and what not.. Last night it was hacked? All directorys are now GONE!! I do have a backup but would like to find an address of the attacker.. how would I go about finding this ?

Thanks in advance.
Jek.
 
Old 03-06-2005, 07:00 PM   #2
ssimontis
Member
 
Registered: Apr 2004
Location: USA
Distribution: Fedora Core 3
Posts: 128

Rep: Reputation: 15
First off, make sure it is a hacker, and that your HD didn't fail or anything similar. However, I suppose you could look at network logs for suspicious activity if you have them somewhere.
 
Old 03-06-2005, 07:27 PM   #3
narmida
Member
 
Registered: Mar 2005
Location: Alphen aan den Rijn , netherlands
Distribution: core
Posts: 57

Rep: Reputation: 15
Second if all directory where gone only root could do this.

NO MATTER WHAT HANGS ON THE INTERNET IT NEEDS TO BE SECURED AND UPDATED AT A DAY BASES IF NOT 24/7

If you dont know what youre doing make sure you find out ASAP.

All main distro are at default not so mega secure as man may think.

Examples some service should not be on at default ssh should not run at v1 and a choice for running no firewall is stupid, login thru root thru ssh and so on.

i think you had it on the internet with a ssh port open and a bloody simpel password like god ;-( dont make users like test with password test
if you do youre fucked for sure within 30 days.

This is not a flame i realy hope you will learn from it and make sure it wont happen again.
Makes the world much saver.

Use the basic rules :

use long and no simpel passwords
close ssh for v1 and use allow user .... (no root)
use chkconfig --level 345 yum on
update at daily bases auto
check logs
etc etc look it up.

did you know there are in the world every 1 second 2 attacks on major systems of the internet.
This is mainly done thru a machine that was hacked like yours.
I think the hacker (script kiddie) screwed up his own script :-)


On my webserver i get 40.000 hack attemps on my ssh only a WEEK if i installed FC basic.
with help of tools like portsentry etc etc it is reduced to under 10 mostly 0


But youre server could be used if hacked to take part of a DDOS atack on the whitehouse, NASA, or in our country the dutch goverment internet sites.

If this happens youre provider must take youre DSL connection offlline and this is costing you money so that why in typing the whole to long story ;-)

all comes to 1 thing MONEY

Be safe and ask if you dont know we can help you
 
Old 03-06-2005, 08:10 PM   #4
Jek
LQ Newbie
 
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0
Thanks for the reply.. I always update, I admit I need to know more about it.

I do however want to know how to find the logs though.. Is it possible ?
 
Old 03-06-2005, 08:19 PM   #5
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Quote:
All directorys are now GONE!!
What exactly is gone, and if it's everything from
underneath /var/log are you sure you didn't accidentally
clean it up yourself?


Cheers,
Tink
 
Old 03-06-2005, 08:34 PM   #6
Jek
LQ Newbie
 
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0
Honestly,

I think being a PC tech for a living I would know if I DELETED my entire WWW directory.

It was there last night, when I got up today it's gone.

Last edited by Jek; 03-06-2005 at 08:36 PM.
 
Old 03-06-2005, 08:48 PM   #7
IchBin
Member
 
Registered: Dec 2004
Distribution: Tinysofa Classic
Posts: 75

Rep: Reputation: 15
Usually the logs are in /var/log/secure or /var/log/messages
Good luck I hope you find some info.
 
Old 03-06-2005, 08:50 PM   #8
Jek
LQ Newbie
 
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by IchBin
Usually the logs are in /var/log/secure or /var/log/messages
Good luck I hope you find some info.
Thank you very much.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Ubuntu logs on, then logs back off generallee5686 Ubuntu 0 10-20-2005 02:11 PM
Firewall logs in logs and terminal... robbow52 Debian 7 11-20-2004 08:13 PM
Firefox logs user out? Where are error logs? case1984 Linux - General 0 10-09-2004 03:22 PM
Separate firewall logs and general logs dominant Linux - General 3 04-20-2004 02:26 AM
Apache logs - ???Linux logs??? mylo2003 Linux - General 3 08-07-2003 05:49 PM


All times are GMT -5. The time now is 07:26 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration