Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?

What logs should I look to, is there any settings I can modify so such things can't happen again in future.

Thanks

share|improve this question

migrated from serverfault.com Jan 15 '12 at 19:09

This question came from our site for professional system and network administrators.

2 Answers 2

up vote 4 down vote accepted
  1. First of all were you sure it was your client and that your system has not been compromised ?
  2. Backup your logs
  3. Contact the police if necessary
  4. How was the DDoS done ?

Make sure your firewall is up and scan your own host with nmap to look for ports that should not be open.

If your client can only use PHP or Shell scripts, you can limit the time and memory his scripts can use. This makes it harder, but not impossible to do an attack.

If your system is compromised you can NOT TRUST it anymore! Rootkits can hide a lot, including feeding you wrong statistics in top or disk usage !

EDIT

If it is a VPS I suspect you got an IP from the destination it has been attacking ? If not ask for the IP.

If you are using NAT then ask them to send you the port range from where the attack occurred. So you can identify the VPS that has been causing trouble.

share|improve this answer
    
attacker sended 40k packets per sec from my server, I have VPS's on that machine, is it possible to make DDoS attack from a VPS machine? –  ProDraz Jan 15 '12 at 19:14
    
yes it is, so try to identify it. –  Lucas Kauffman Jan 15 '12 at 19:37
    
My issue is I don't know how to :S –  ProDraz Jan 15 '12 at 19:44
    
I'll add it to the answer –  Lucas Kauffman Jan 15 '12 at 19:46

If the DDOS is active at the time of investigation, then you can usually spot it by the fact that it is in "R" running state, in order to continually make new connections (try it a few times):

ps uaxwf | grep ' R'

If not that, then you can spot it by network connections that it is making -- connections made by user PHP and CGI scripts are suspicious:

netstat -antup

Usually DDOS scripts are PHP or CGI scripts running without root privileges. If you find DDOS running with root privileges, then you have a problem.

If you allow incoming connections, then you may have a listening shell:

netstat -lntup

Failing this, you can look for a high volume of recent POST's to a single site. Not all back door shells use POST, but it is releatively popular. This will do it:

find /usr/local/apache/domlogs -type f -mmin -10 -maxdepth 1 |
   xargs tail -F -n 10 | grep POST

If you find something unusual like rsknnf.php, it's probably a backdoor shell, although occasionally they are hidden a few levels deep in some CMS's source code. If you find one, then kill the account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.