-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 23 May 2006 09:27:01 -0400 (EDT) Tom Diehl <tdiehl@xxxxxxxxxxxx> wrote: > On Tue, 23 May 2006, Les Mikesell wrote: > > > On Tue, 2006-05-23 at 02:45, Paul Howarth wrote: > > > > > I don't think that's what this is. Form spam takes advantage of > > > poorly-coded mail/contact forms and uses them to send mail to recipients > > > other than those intended by the form designer. > > > > > > What's happening here is that the spammer is running their own code > > > (downloaded into /tmp) to send the mail, a rather more serious > > > situation. > > An old version of awstats will get you into this club, as will some of the > php based forum programs. > > All it takes is for someone to install one of these in a document root and > not keep up with the updates. It is insanely trivial to exploit one of > these boxes. It even gets logged in the http logs for all to see. > The hardest part if figuring out when it actually happened so you can find > it in the logs. > > > If you have ssh access open there's a fair chance that someone > > has done a brute-force password guess. There is a lot of > > that going around. Or you didn't apply all of the current > > updates before exposing the system to the internet. > > I suspect if ssh had been compromised that the user would have been something > other than apache. The passwd entry for apache generally looks something like > this: apache:x:48:48:Apache:/var/www:/sbin/nologin. Given this entry an ssh > login as apache would not be possible via brute force passwd attack vectors. > > Regards, > > Tom Diehl tdiehl@xxxxxxxxxxxx Spamtrap address > mtd123@xxxxxxxxxxxx > I looked in those logs and there is none of that. I have ssh turned off and sudo uninstalled. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEcyqNfw3TK8jhZrsRAppvAKDbltkHlIw4rZBy5ViUyOXgTdM+/wCfZTCb zn+nAEQsuKRMaka/0sFgLRQ= =omQu -----END PGP SIGNATURE-----
