I have a Apache VPS by GoDaddy with Wordpress and the Enfold theme. Both are up to date, no additional plugins are installed.
The server frequently gets hacked, and malicious PHP code gets injected to the file structure. Those files send tons of emails out.
I do not know where/ how the attackers enter the website. All passwords have been changed. I set up the following iptable rule
-A INPUT -p tcp -m tcp -m multiport ! --dports 20,21,80,443,1030,2083,2086,2087
to block all ports not needed for the website use and development. (1030 is SSH)
Also, the website is using the cloudflare WAF...
Is there any way to write a bash script which monitors all incoming connections to the server, what port and file they have accessed and logs it? So the next time files get injected i can follow the request at this time and see what connections / IP / service was used.
Thank you for any help to solve the issue. I ideally would not only want to know how to block the attacks but also how they are conducted and what vulnerabilities they are using. As the hack is sending out emails ony, and we don't need exim at the moment, i can easily disable the email server. This way i can try different approaches and observe the attack more often to understand what is really going on.