Today I got reports about one of my websites becoming inaccessible. I've come to learn that at the time we were under DDOS attack.
After getting through that, the website started throwing a permission denied error, so I narrowed it down to the .htaccess and sure enough, it had been changed to deny all.
My question is, are there any default mechanisms in apache, or centos, that might have been triggered and caused the .htaccess to be altered?
I've scoured the log files, and there is some evidence that there might have been a breach, but literally only 1 file was changed outside of that. /etc/logs/secure seems to have missing logs for roughly 40 minutes during the attack.
Can a DDOS attack cause the server to not continue adding entries to the logs?
Thanks for any info, or directions to look.