Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my sites are running Joomla ranging from 1.5 installs (which cannot be upgraded because the customers have declined the upgrade, really its only 2 sites running 1.5) to 3.1 installs. I am not sure where the vulnerability is. i have gone through all of my scripts and enabled captcha, changed my admin passwords, changed my database passwords, and checked my extensions against joomla's vulnerable extension list. what else can i set up to prevent this from happening? THis is about my 5th attack in a year, and about my 5th time tightening the belt on everything just to have my efforts fail....grrrrr

share|improve this question

closed as off-topic by tylerl, NULLZ, Lucas Kauffman, TildalWave, Adi Jul 26 '13 at 7:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – tylerl, NULLZ, Lucas Kauffman, Adi
If this question can be reworded to fit the rules in the help center, please edit the question.

Simply shut off sites that will not upgrade. Failure to follow a proper upgrade path which allows for everyone else to lose their services should not be tolerated. – Fiasco Labs Jul 27 '13 at 4:19

Don't host customers who decline to keep their software updated. There is no other option if you don't want your sites to be hacked. It is impossible to secure vulnerable software.

Also, any site that has been hacked needs to be wiped out completely and reinstalled from scratch or a known-good backup. Again, no other option is safe.

share|improve this answer

Identify the source of the compromise and drop the client if they won't fix their vulnerabilities (or charge them for their own dedicated VPS and tell them they are responsible for the compromises.) The only way to stop being compromised is to fix the problems allowing you to be compromised.

share|improve this answer
I do not believe he fully knows where he is being compromised which could be part of the problem – cutrightjm Jul 26 '13 at 4:26
@Ekaj - that may be the case, but in that case, without more details, we can't really help him with that either and it would likely be too localized anyway. – AJ Henderson Jul 26 '13 at 13:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.