Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?

What logs should I look to, is there any settings I can modify so such things can't happen again in future.

Thanks

share|improve this question
add comment

migrated from serverfault.com Jan 15 '12 at 19:09

This question came from our site for professional system and network administrators.

1 Answer

up vote 4 down vote accepted
  1. First of all were you sure it was your client and that your system has not been compromised ?
  2. Backup your logs
  3. Contact the police if necessary
  4. How was the DDoS done ?

Make sure your firewall is up and scan your own host with nmap to look for ports that should not be open.

If your client can only use PHP or Shell scripts, you can limit the time and memory his scripts can use. This makes it harder, but not impossible to do an attack.

If your system is compromised you can NOT TRUST it anymore! Rootkits can hide a lot, including feeding you wrong statistics in top or disk usage !

EDIT

If it is a VPS I suspect you got an IP from the destination it has been attacking ? If not ask for the IP.

If you are using NAT then ask them to send you the port range from where the attack occurred. So you can identify the VPS that has been causing trouble.

share|improve this answer
    
attacker sended 40k packets per sec from my server, I have VPS's on that machine, is it possible to make DDoS attack from a VPS machine? –  ProDraz Jan 15 '12 at 19:14
    
yes it is, so try to identify it. –  Lucas Kauffman Jan 15 '12 at 19:37
    
My issue is I don't know how to :S –  ProDraz Jan 15 '12 at 19:44
    
I'll add it to the answer –  Lucas Kauffman Jan 15 '12 at 19:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.