I have a server, it's outdated running Debian Lenny, and yes I know that is probably half the problem. It also has PHPMyAdmin and ProFTPd. Again, I get it, all bad signs.
But for the life of me, I cannot figure out how this user is logging in and adding files and executing commands.
They are able to start
screen sessions, and type things like
nano file.sh and then create a script and
./file.sh to execute it. Does this mean they have SSH access? I don't understand.
I check all of my log files, and nothing anywhere shows successful authentication. I check
last, every little command I can type - nothing shows any signs of someone being logged in.
Every now and again, I notice they create new directories and the owner is
1XXX, but these accounts don't show up when I look for them.
Is there something I can do to figure out wtf is going on? We are going to wipe the server clean, don't get me wrong, but I'd like to know what happened exactly so I can avoid this sort of problem in the future.
I don't want any recommendations regarding "don't use phpmyadmin, old unsupported distros, ftp, etc.", on our new server we won't have anything insecure, and will use passworded SSH Auth keys, etc.
I just want a bit of insight on how I can know when the user is logged in, and where they logged in from. Granted, I'm probably not giving enough information, but maybe something will click for someone? Thanks.