Исходное сообщение
"В Сети зафиксирован массовый взлом серверов на базе Linux" Отправлено odesk, 19-Фев-13 20:42
"Steven - sorry for being unclear. I didn't mean to imply the initial attack was from ssh; what I meant was that an iptables block on ssh stopped them reconnecting, exactly as you've seen. Is the following consistent with what you've seen? 1. User account compromised at PHP level 2. Compromised account used to hack root and backdoor sshd via libkeyutils 3. Spam sent The question being, how is the #2 root hack being done, #1 could be through any vulnerable site CMS etc. " http://www.webhostingtalk.com/showthread.php?t=1235797 Я думаю этот кусок причинной ветки новости все проясняет для профессиональных администраторов. Нельзя пускать "php" "web-софт" на системный уровень. ИМХО. Мои клиента на "панель" не ходят :-)