[ubuntu-uk] off topic - server security

[Tony Arnold]

Sean,

Sean Miller wrote:
> Yes, Tony... I suspect that one or more of the installed scripts are the
> issue but not sure where to find out for sure... would be difficult to
> turn to a customer and say "sorry, you can't have your phpBB forum"
> unless I knew for sure what it was they were exploiting - anyway, I'd
> rather patch it than tell people they can't have things (at least in the
> first instance).

The process details should be able to tell you where the files are that
are being run (there is an option to ps that will tell you the full path
being executed by a process). I would try and cross reference that with
entries in the Apache log files. Should give you some clues.

Regards,
Tony.
-- 
Tony Arnold, IT Security Coordinator, University of Manchester,
IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL.
T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039
E: tony.arnold at manchester.ac.uk, H: http://www.man.ac.uk/Tony.Arnold