Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • Thanks a lot for your input. The machine is actually NATed and the only ports that are forwarded are http, https, ssh, ftp, ldap, smtp (TCP) and ipsec (UDP). I'm now 100% sure they didn't use any web app or anything because to get in their IPs are only in auth.log and fail2ban.log (also, see my last edit). Then, I'm 90% sure they didn't get root access because they only attempted one exploit which failed. It is though very bad because a lot of private files were actually readable by postgres (seriously, WTF is wrong with this user account) Commented Feb 10, 2018 at 12:53
  • Can you help me get information about the wallet part? I've never used or documented myself on crypto currencies. The wallet configuration file contains: threads = 0 mining-params = xmr:av=0&donation-interval=50 mine = stratum+tcp://etnXXXX:yam@188.***.***.***:3333/xmr compact-stats = 1 print-timestamps = 0 (private data redacted) Commented Feb 10, 2018 at 12:58