My server is used for DDoS attacks

Question

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?

What logs should I look to, is there any settings I can modify so such things can't happen again in future.

Thanks

Answer 1

1. First of all were you sure it was your client and that your system has not been compromised ?
2. Backup your logs
3. Contact the police if necessary
4. How was the DDoS done ?

Make sure your firewall is up and scan your own host with nmap to look for ports that should not be open.

If your client can only use PHP or Shell scripts, you can limit the time and memory his scripts can use. This makes it harder, but not impossible to do an attack.

If your system is compromised you can NOT TRUST it anymore! Rootkits can hide a lot, including feeding you wrong statistics in top or disk usage !

EDIT

If it is a VPS I suspect you got an IP from the destination it has been attacking ? If not ask for the IP.

If you are using NAT then ask them to send you the port range from where the attack occurred. So you can identify the VPS that has been causing trouble.

Answer 2

If the DDOS is active at the time of investigation, then you can usually spot it by the fact that it is in "R" running state, in order to continually make new connections (try it a few times):

ps uaxwf | grep ' R'

If not that, then you can spot it by network connections that it is making -- connections made by user PHP and CGI scripts are suspicious:

netstat -antup

Usually DDOS scripts are PHP or CGI scripts running without root privileges. If you find DDOS running with root privileges, then you have a problem.

If you allow incoming connections, then you may have a listening shell:

netstat -lntup

Failing this, you can look for a high volume of recent POST's to a single site. Not all back door shells use POST, but it is releatively popular. This will do it:

find /usr/local/apache/domlogs -type f -mmin -10 -maxdepth 1 |
   xargs tail -F -n 10 | grep POST

If you find something unusual like rsknnf.php, it's probably a backdoor shell, although occasionally they are hidden a few levels deep in some CMS's source code. If you find one, then kill the account.

Answer 3

As you are running VM's you should just check the VM's firewall, bandwidth and CPU graphs as they will most likely show a spike, then you will know what client to blame.

If you have screwed up and don't have any resource monitoring set up (and therefore don't know how it occurred) then you should probably just wipe the server to be sure and start over, and do it properly this time.

You can limit your clients access to resources, such as packets per second and bandwidth, but that might in some cases give your customers a bad experience.

The best thing is probably to monitor and react to suspicious activity.