<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<div>Those attacks can only be done because someone has gotten access to your server!!</div>
<div>
<br /></div>
<div>Start by going into the GUI and changing the password on the "Admin" account. If I remember right - that will also set the root password to that same password.</div>
<div>
<br /></div>
<div>Then jump into the server as root at the command line. See who else is logged in using the "who" command. You should see a entry for your "root" login, and anyone else logged in. If you do see another entry - there is the problem, someone in at the command line using your box to initiate attacks.</div>
<div>
<br /></div>
<div>First, change the password for that other account. You can do it at the command line with "passwd abcde" (abcde is the username). Or use the GUI. Then log them out. At the command line, use "ps -ax" to see the processes in use. Look for one with something like "sshd abcde@pts#". The entry will start with a process number. Kill the process with "kill -9 ####". That will log the offending person out, and your change of the password will keep him out.</div>
<div>
<br /></div>
<div>Then you simply have to figure out how he got the password to a user account. And if I were you - I'd go into the GUI and take away "shell" access to everyone except Admin.</div>
<div>
<br /></div>
<div>
<br /></div>
<div>Chuck</div>
<div>
<br /></div>
<div>
<br /></div>
<div>
<br /></div>
<font size="2"><b>---------- Original Message
-----------</b>
<br />
From: "Don Teague" <blueonyx@donteague.com>
<br />
To: "BlueOnyx General Mailing List" <blueonyx@mail.blueonyx.it>
<br />
Sent: Sat, 20 Jul 2019 17:11:48 +0000
<br />
Subject: [BlueOnyx:23005] SSH outbound attacks
<br />
<br />> I have no idea where to start with this one.
<br />>
<br />> Somehow
I've got outbound SSH attacks happening from one of my servers. No idea how it's
happening, etc. Where does one even begin to troubleshoot this?
<br />>
<br />>
(Of course first I have to figure out why I can't log in via GUI, but can via
console.)
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>