if they accessed your system through FTP then I would sugesting your FTP config to disalow root login
You know, I looked at that, and it was configured that way. I'm still not 100% sure of how they got in.
You didn't mention your effort to clean the system, so I thought I'd float that notion of concern.
As near as I can tell, they 1) changed my root password, 2) set up another root-access account for themselves called "test", 4) deleted the logs (they misspelled "messages" when they deleted/re-created the log files, and 5) started a DOS attack.
So, once I got the system back up and running, I
1) changed my root password... if they're doing a brute-force hack on *THAT* one, it will take YEARS.
2) deleted the "test" account they had created
3) Turned OFF FTP on my port forwarding; it will be inconvenient, but it closes the hole
4) Installed the script mentioned by thedaver... so any attacks on my sshd port (I need *some* way to get into the system remotely) will follow the "3 strikes and you get added to /etc/hosts.deny" rule.
I had at one point changed the root user name to something different, however Postfix started to really gripe about it, since it evidently uses sudo, and said "root doesn't own the file", etc. Since the hackers have been trying to log in with uid=0 instead of "root", it didn't really matter WHAT the root account was named, so I changed it back.
Additionally, the only spot that root is allowed to log on now is at the console. I never log on as root unless I'm at the console anyway; best practice is to su when you need to do something as root, so that you don't accidently do things (ultimate power corrupts ultimately.. hehe)
I also thoroughly examined my web directories, to make sure they hadn't dropped a perl backdoor or other such nasty in there while they were there.
Overall, I think I "caught" it soon enough before the system became *REALLY* compromised. Security logs are e-mailed to me daily, and every day I go through and add IP addresses to my /etc/hosts.deny who have attempted to gain root access. The script that thedaver gave me will not only automate that, but there won't be a "lag" between the time that someone attempted to gain access, and the logwatch e-mail is generated.
I *suspect* that they got in through FTP, since my logwatch was telling me of failed attempts into ftp using uid=0; although they could have done a brute-force against sshd... they wouldn't have been able to do a dictionary attack against it.... I always use "strong" passwords. The password that's on root now is rediculous...well over 10 characters (I won't say how MANY over 10 characters... hehe). That's why I was floored when someone got in.
I know at one time I had a "weak" version of awstats, and someone "pwnd" my web page. (that ticked me off, too), but since then, I've been keeping awstats up-to-date with security patches. It's a possibility that they got in that way, but somehow I doubt it.
Just my 2¢
"In order to start solving a problem, one must first identify its owner." --Me
--Greg
erlDesignPatterns)[/small]