Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 03-06-2005, 06:58 PM   #1
LQ Newbie
Registered: Feb 2004
Posts: 18

Rep: Reputation: 0
Logs ?

Hi all,

I have been running a fedora C2 webserver at home for a while just to host some family photos and what not.. Last night it was hacked? All directorys are now GONE!! I do have a backup but would like to find an address of the attacker.. how would I go about finding this ?

Thanks in advance.
Old 03-06-2005, 07:00 PM   #2
Registered: Apr 2004
Location: USA
Distribution: Fedora Core 3
Posts: 128

Rep: Reputation: 15
First off, make sure it is a hacker, and that your HD didn't fail or anything similar. However, I suppose you could look at network logs for suspicious activity if you have them somewhere.
Old 03-06-2005, 07:27 PM   #3
Registered: Mar 2005
Location: Alphen aan den Rijn , netherlands
Distribution: core
Posts: 57

Rep: Reputation: 15
Second if all directory where gone only root could do this.


If you dont know what youre doing make sure you find out ASAP.

All main distro are at default not so mega secure as man may think.

Examples some service should not be on at default ssh should not run at v1 and a choice for running no firewall is stupid, login thru root thru ssh and so on.

i think you had it on the internet with a ssh port open and a bloody simpel password like god ;-( dont make users like test with password test
if you do youre fucked for sure within 30 days.

This is not a flame i realy hope you will learn from it and make sure it wont happen again.
Makes the world much saver.

Use the basic rules :

use long and no simpel passwords
close ssh for v1 and use allow user .... (no root)
use chkconfig --level 345 yum on
update at daily bases auto
check logs
etc etc look it up.

did you know there are in the world every 1 second 2 attacks on major systems of the internet.
This is mainly done thru a machine that was hacked like yours.
I think the hacker (script kiddie) screwed up his own script :-)

On my webserver i get 40.000 hack attemps on my ssh only a WEEK if i installed FC basic.
with help of tools like portsentry etc etc it is reduced to under 10 mostly 0

But youre server could be used if hacked to take part of a DDOS atack on the whitehouse, NASA, or in our country the dutch goverment internet sites.

If this happens youre provider must take youre DSL connection offlline and this is costing you money so that why in typing the whole to long story ;-)

all comes to 1 thing MONEY

Be safe and ask if you dont know we can help you
Old 03-06-2005, 08:10 PM   #4
LQ Newbie
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0
Thanks for the reply.. I always update, I admit I need to know more about it.

I do however want to know how to find the logs though.. Is it possible ?
Old 03-06-2005, 08:19 PM   #5
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 927Reputation: 927Reputation: 927Reputation: 927Reputation: 927Reputation: 927Reputation: 927Reputation: 927
All directorys are now GONE!!
What exactly is gone, and if it's everything from
underneath /var/log are you sure you didn't accidentally
clean it up yourself?

Old 03-06-2005, 08:34 PM   #6
LQ Newbie
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0

I think being a PC tech for a living I would know if I DELETED my entire WWW directory.

It was there last night, when I got up today it's gone.

Last edited by Jek; 03-06-2005 at 08:36 PM.
Old 03-06-2005, 08:48 PM   #7
Registered: Dec 2004
Distribution: Tinysofa Classic
Posts: 75

Rep: Reputation: 15
Usually the logs are in /var/log/secure or /var/log/messages
Good luck I hope you find some info.
Old 03-06-2005, 08:50 PM   #8
LQ Newbie
Registered: Feb 2004
Posts: 18

Original Poster
Rep: Reputation: 0
Originally posted by IchBin
Usually the logs are in /var/log/secure or /var/log/messages
Good luck I hope you find some info.
Thank you very much.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Ubuntu logs on, then logs back off generallee5686 Ubuntu 0 10-20-2005 02:11 PM
Firewall logs in logs and terminal... robbow52 Debian 7 11-20-2004 08:13 PM
Firefox logs user out? Where are error logs? case1984 Linux - General 0 10-09-2004 03:22 PM
Separate firewall logs and general logs dominant Linux - General 3 04-20-2004 02:26 AM
Apache logs - ???Linux logs??? mylo2003 Linux - General 3 08-07-2003 05:49 PM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 02:55 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration