Ещё вот что-то бегло по-мелочам посмотрел по теме.
И при возникновении проблем свалить всё на gnu/linux. Достаточно распространённое поведение, причём касаемо не только хостинга.
Угумс...
И как кто-то говаривал тут на форуме, запасаемся попкорном:
There is one red flag that my friend mentioned - he recently (about 10 days ago) used a third party contractor to perform some work as root. This contractor had the login details to the machine that is affected. This may be a red herring but that always concerns me, expecially as some have posted in this thread asking if a third party contractor has recently worked on infected machines.
Does anyone know what this is, I did a ls randomly as the root user and found something called ipadd.sh, I've never seen it before
As steven said... There are a *lot* of people using RedHat/CentOS/Cloud Linux/ etc for hosting, cPanel, etc.
Also these OS'es, by default, allow you to ssh in as root, vs some of the other operating systems disable root login. I suspect not as many people change this as a security expert would think.
The servers were also accessed on 3 different systems over the network. On one of these systems we detected a rootkit installed about 3 to 4 days ago which was removed.
I was searching till now for some evidence why this happened till 2 days ago. Since the start I was using SSH keys login to my VPS and not password. The day my server has this root access, it was the day I send the root password to cPanel helpdesk to help me out with a server problem. I am not sure if it has anything to do with it(changed afterwards and disabled password login).
Two days ago, I removed libkeyutils.so.1.9 (I have a backup of it) and it seems (??) that the server is not re-compromised. At least no new file was created.
it's probably "just" sniffed SSH passwords (I always wonder how many guys allow root login with plaintext passwords...
I've checked my other machine runing CentOS 6.3 (only Webmin and CS:GO server installed) and the system is not infected.
On the other hand, first machine running CentOS 5.9 and cPanel/WHM (with 100+ web sites) is constantly getting infected.
Both machines are "updated" from same centos repo in Croatia (Plus hosting).
Ну вы поняли, чё сказать-то хотел...
Ни один самый защищённый линукс не поможет если ....
И как сказал один пользователь виндовс: треть любого крекинга состоит из социальной инженерии.
Так что, соблюдайте правила гигиены.
