2 I think you meant SFTP right, not SCP? Also, some edits to grammar and phrasing.
source | link

Are you saying that your permissions were 755 but are now 754 or 644? Looking at my apacheApache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol somewhere along the FTP connection), and then performed privilege escalation (through a vulnerability in the FTP service, Apache (unlikely: not aware of any at the minutemoment), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front, unless someone throughthrew a 0-day your way, again unlikely but possible if you've data that someone really wants) or finally via your web application depending on how well it'sits coded, php). PHP apps are renowned for being insecurely developed and are frequently vulnerable for exploitationexploitable.

I'd recommend removing FTP access and replacing it with SCPSFTP (using key authentication).

Are you saying that your permissions were 755 but are now 754 or 644? Looking at my apache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol) and then performed privilege escalation (through a vulnerability in FTP, Apache (unlikely not aware of any at the minute), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front unless someone through a 0-day your way, again unlikely but possible if you've data that someone really wants) or finally via your web application depending on how well it's coded, php apps are renowned for being insecurely developed and are frequently vulnerable for exploitation.

I'd recommend removing FTP access and replacing it with SCP (using key authentication).

Are you saying that your permissions were 755 but are now 754 or 644? Looking at my Apache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol somewhere along the FTP connection), and then performed privilege escalation (through a vulnerability in the FTP service, Apache (unlikely: not aware of any at the moment), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front, unless someone threw a 0-day your way, again unlikely but possible if you've data that someone really wants) or via your web application depending on how well its coded). PHP apps are renowned for being insecurely developed and are frequently exploitable.

I'd recommend removing FTP access and replacing it with SFTP (using key authentication).

    Post Migrated Here from superuser.com
1
source | link

Are you saying that your permissions were 755 but are now 754 or 644? Looking at my apache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol) and then performed privilege escalation (through a vulnerability in FTP, Apache (unlikely not aware of any at the minute), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front unless someone through a 0-day your way, again unlikely but possible if you've data that someone really wants) or finally via your web application depending on how well it's coded, php apps are renowned for being insecurely developed and are frequently vulnerable for exploitation.

I'd recommend removing FTP access and replacing it with SCP (using key authentication).