Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a VPS that only has Wowza media server installed on it. I got a report from my VPS admin that my VPS is sending SPAM by attacking other servers from SSH. I have no idea what could be the reason for that.

I use MAC Terminal to access my VPS. Is it a Virus? my password compromised? How do I find out?

Details from VPS Admin: "It’s not spam as in Spam Email, it is spam from SSH console connections. The server had been being used with a bot to try and SSH different equipment throughout the world. "

share|improve this question
    
If you don't, even after it is explained, know the difference between spam and attempts to compromise another server, you should close down your server and pay someone who is trained and skilled to handle hosting for you. –  CarlF Oct 27 '10 at 18:46
    
There are different ways to learn. Plus I'm quoting the VPS admin clarification above I was using his terminology when I used SPAM. –  Tam Oct 27 '10 at 20:42

1 Answer 1

So, you didn't mean it was sending spam (unsolicited commercial email) after all? You meant that it was attempting to SSH onto other systems... please edit your question to make that clear since it's completely different to what you've written.

Back on topic, this means your server is compromised. You need to immediately disconnect it and find out how that happened. There are 2 likely causes:

  1. Vulnerable, unpatched, services running
  2. SSH password weak and either guessed or brute forced, and you've allowed root logins over SSH

The latter may be easy to identify by looking at the system logs for entries from SSH, or possibly just using the last command (both assumes that the attacker isn't careful and trying to hide their tracks).

share|improve this answer
    
Sorry if I wasn't clear. the SPAM was more like my server was trying to SSH to another server. I don't Have Mail server installed on the server –  Tam Oct 27 '10 at 17:12
    
@netvope - I assume your comment is addressed to Tam? –  Cry Havok Oct 27 '10 at 17:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.