Re: possible server compromitation

2006-08-21 Thread David Siroky
Jon Dowland píše v Po 21. 08. 2006 v 19:05 +0100: > On Mon, Aug 21, 2006 at 06:44:00PM +0200, David Siroky > wrote: > > Attackers deleted all access.log and error.log files > > (which I had among the web files) > > I assume by "among the web files" you mean you'd adjusted > permissions on the logg

Re: possible server compromitation

2006-08-21 Thread Jon Dowland
On Mon, Aug 21, 2006 at 06:44:00PM +0200, David Siroky wrote: > Attackers deleted all access.log and error.log files > (which I had among the web files) I assume by "among the web files" you mean you'd adjusted permissions on the logging directory so the apache user could write to them: by default

Re: possible server compromitation

2006-08-21 Thread David Siroky
Sergio Cuéllar Valdés píše v Po 21. 08. 2006 v 09:51 -0500: > On 8/21/06, David Siroky <[EMAIL PROTECTED]> wrote: > > Hi! > > > > I have an urgent situation. On one of my servers disapeared all apache > > "error.log" and "access.log" files and other files containing "logo" or > > "login". I found s

Re: possible server compromitation

2006-08-21 Thread Roberto C. Sanchez
On Mon, Aug 21, 2006 at 12:03:08PM +0200, David Siroky wrote: > Hi! > > I have an urgent situation. On one of my servers disapeared all apache > "error.log" and "access.log" files and other files containing "logo" or > "login". I found some unknown processes. > > # ps -el > ... > 1 S 5000 1008