Security Incidents: Re: Help please

[H C <keydet89 () yahoo com>]

Ryan,

Great information, but what are you asking for?  You
say you can see the guy connected...what port is he
connecting on?  

Have you tried blocking the port, or killing the
process on the local box itself?

What do ps and lsof (or fuser) tell you?

Do your logs tell you anything about how the guy got
in?

Also, since you've posted from your domain, I wouldn't
be surprised if you see other connection attempts to
that box...



--- Ryan Hairyes <rhairyes () lee k12 nc us> wrote:
> Hello all.
>
>
> I am having some trouble and would like to know if
> someone can help me out.
> Right now my mailserver (RedHat 7.2) is being used
> by unwanted guest to 
> attack adult sites via port 80 (Apache 1.3.20). 
> When I run a netstat -an
> on my system I can "see" them connected to my
> machine.  I have snort and 
> have run that as well and sure  enough they are
> there.  It seems as though
> they are using my apache to do brute force password
> cracking on these adult
> sites.  Thanks in advance.
>
> Ryan
>
>
> --------------------
> Ryan Hairyes
> Network Administrator -- Lee County School System
> 919.774.6226 x 1252
> rhairyes () lee k12 nc us
----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS
> analyzer service.
> For more information on this free incident handling,
> management 
> and tracking system please see:
> http://aris.securityfocus.com

__________________________________________________
Do You Yahoo!?
Great stuff seeking new owners in Yahoo! Auctions! 
http://auctions.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com