<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/3.24.1.1"> </HEAD> <BODY> On Thu, 2009-02-12 at 13:43 -0500, H.S. wrote: <BLOCKQUOTE TYPE=CITE> <PRE> Walton Hoops wrote: > I could use some help from the Ubuntu wizards out there. > I run a home server, using Ubuntu 8.10. It very low traffic, with most of > the traffic being e-mail. Last night, over the course of an hour it > recorded roughly 8 GB (4 up and 4 down) of traffic over the course of 2 > hours (monitoring with vnstat) and then dropped back to normal. Looking at > the logs, the traffic did not come through apache, sendmail,or SSH. Judging > from the fact that the up/down are equal, I'm guessing I've was used as a > proxy for something (I don't have a proxy server installed), but I know not > what. So, I have two questions. > 1.) Any suggestions on how to further investigate this? At this point I'm > at a loss. > 2.) How would you suggest further hardening my security, since it seems it > was compromised? I use Firestarter to lock down my ports, Fail2Ban to stop > those pesky SSH brute force attacks, and Snort to keep an eye out for other > attacks. > Any input would be appreciated. > Walton > > I am no security expert, but I would suggest you take out the network cable of that machine till you are sure it has not been compromised. Are there other machines on this network? </PRE> </BLOCKQUOTE> First place I would start is to check your logs for successful ssh connections: <PRE> grep Accepted /var/log/auth.log </PRE> This will show you date/time and IP address of successful SSH connections. To check if any of these have gained root permissions through su: <PRE> grep Successful /var/log/auth.log </PRE> What services are open on the machine in question? I would then check the logs for each of the services in question around the time of the activity to see in detail exactly which service generated/consumed the traffic. At what point are you observing the bandwidth, is this on a router, on the eth0 interface of the machine or an aggregate of all interfaces? Is it theoretical that 4G out and then in could be on a loopback interface? Guy. </BODY> </HTML>