On Thu, Jul 21, 2005 at 11:49:53PM +0200, Karsten Dambekalns wrote: > Another question came up here. Is it really likely to be a SSH brute force > break in, or could the attacker have been able to log in some other way? What > is currently possible in that respect on a machien that runs ssh, apache, > php, exim and nothing else (all as of Debian 3.1)?
Didn't one of your logs show overwriting the apache logs? Seems like the attacker was trying to cover up something there. -- Rob -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
