up vote 0 down vote favorite
share [g+] share [fb]

I have a VPS that only has Wowza media server installed on it. I got a report from my VPS admin that my VPS is sending SPAM by attacking other servers from SSH. I have no idea what could be the reason for that.

I use MAC Terminal to access my VPS. Is it a Virus? my password compromised? How do I find out?

Details from VPS Admin: "It’s not spam as in Spam Email, it is spam from SSH console connections. The server had been being used with a bot to try and SSH different equipment throughout the world. "

link|improve this question
70% accept rate
If you don't, even after it is explained, know the difference between spam and attempts to compromise another server, you should close down your server and pay someone who is trained and skilled to handle hosting for you. – CarlF Oct 27 '10 at 18:46
There are different ways to learn. Plus I'm quoting the VPS admin clarification above I was using his terminology when I used SPAM. – Tam Oct 27 '10 at 20:42
feedback

1 Answer

up vote 1 down vote

So, you didn't mean it was sending spam (unsolicited commercial email) after all? You meant that it was attempting to SSH onto other systems... please edit your question to make that clear since it's completely different to what you've written.

Back on topic, this means your server is compromised. You need to immediately disconnect it and find out how that happened. There are 2 likely causes:

  1. Vulnerable, unpatched, services running
  2. SSH password weak and either guessed or brute forced, and you've allowed root logins over SSH

The latter may be easy to identify by looking at the system logs for entries from SSH, or possibly just using the last command (both assumes that the attacker isn't careful and trying to hide their tracks).

link|improve this answer
Sorry if I wasn't clear. the SPAM was more like my server was trying to SSH to another server. I don't Have Mail server installed on the server – Tam Oct 27 '10 at 17:12
@netvope - I assume your comment is addressed to Tam? – Cry Havok Oct 27 '10 at 17:43
Yes, sorry if I confused you :) I've deleted it since I can no longer edit it. So you can delete you "Oct 27 at 17:43" comment. I'll delete this one in few days. – netvope Nov 2 '10 at 3:20
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.