My server is used for DDoS attacks

Question

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?

What logs should I look to, is there any settings I can modify so such things can't happen again in future.

Thanks

Answer 1

1. First of all were you sure it was your client and that your system has not been compromised ?
2. Backup your logs
3. Contact the police if necessary
4. How was the DDoS done ?

Make sure your firewall is up and scan your own host with nmap to look for ports that should not be open.

If your client can only use PHP or Shell scripts, you can limit the time and memory his scripts can use. This makes it harder, but not impossible to do an attack.

If your system is compromised you can NOT TRUST it anymore! Rootkits can hide a lot, including feeding you wrong statistics in top or disk usage !

EDIT

If it is a VPS I suspect you got an IP from the destination it has been attacking ? If not ask for the IP.

If you are using NAT then ask them to send you the port range from where the attack occurred. So you can identify the VPS that has been causing trouble.