Today I got reports about one of my websites becoming inaccessible. I've come to learn that at the time we were under DDOS attack.

After getting through that, the website started throwing a permission denied error, so I narrowed it down to the .htaccess and sure enough, it had been changed to deny all.

My question is, are there any default mechanisms in apache, or centos, that might have been triggered and caused the .htaccess to be altered?

I've scoured the log files, and there is some evidence that there might have been a breach, but literally only 1 file was changed outside of that. /etc/logs/secure seems to have missing logs for roughly 40 minutes during the attack.

Can a DDOS attack cause the server to not continue adding entries to the logs?

Thanks for any info, or directions to look.

  • 1
    1) Probably not. 2) Maybe, but it depends. This will be a hard to answer question from here. If in doubt, nuke it from orbit and restore from backup. – Conor Mancone Feb 1 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.