My server provider shutdown one of our servers and it says that is sending a tons of email. When I made a tcpdump I see the following:  04:52:49.743068 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1631:1662, ack 906, win 123, length 31: SMTP: RCPT TO:&lt;fahriozlu@gmail.com&gt; 04:52:49.959999 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 920, win 123, length 0 04:52:50.039830 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1662:1695, ack 920, win 123, length 33: SMTP: RCPT TO:&lt;fahriozlu@hotmail.com&gt; 04:52:50.253412 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 934, win 123, length 0 04:52:50.333509 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1695:1730, ack 934, win 123, length 35: SMTP: RCPT TO:&lt;fahriozparlak@gmail.com&gt; 04:52:50.556870 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 948, win 123, length 0 04:52:50.637048 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1730:1767, ack 948, win 123, length 37: SMTP: RCPT TO:&lt;fahriozparlak@hotmail.com&gt; 04:52:50.854218 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 962, win 123, length 0 04:52:50.934357 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1767:1809, ack 962, win 123, length 42: SMTP: RCPT TO:&lt;fahriozparlak@yenikonya.com.tr&gt; 04:52:51.152141 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 976, win 123, length 0 04:52:51.232339 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1809:1844, ack 976, win 123, length 35: SMTP: RCPT TO:&lt;fahriozsoydan@gmail.com&gt; 04:52:51.446160 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [.], ack 990, win 123, length 0 04:52:51.526295 IP &lt;Our IP&gt;.51796 &gt; mail.dsityre.lk.smtp: Flags [P.], seq 1844:1881, ack 990, win 123, length 37: SMTP: RCPT TO:&lt;fahriozsoydan@hotmail.com&gt;   It sending tons of emails. Those email addresses is not even familiar to us. As you can see it is just changing the domain name of those email address.  Is there anything I can check or do? We already blocked the outgoing domain name in the firewall, but it is still there. We are using debian based linux. Whizzy I think.
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
Losing permissions by adding capability? I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups.   In fact, writing to this file requires the capability, but that is achieved by changing the user namespace. So why does adding the capability to the parent process prevents writing to this file?  me@myhost:~$ unshare -r root@myhost:~# exit logout  me@myhost:~$ sudo setcap cap_sys_admin=ep /usr/bin/unshare me@myhost:~$ unshare -r unshare: cannot open /proc/self/setgroups: Permission denied  me@myhost:~$ sudo setcap cap_sys_admin= /usr/bin/unshare me@myhost:~$ unshare -r root@myhost:~#   By the way: I am running Ubuntu 16.04.4 LTS with kernel version 4.4 and the version of util-linux (including unshare) is 2.27.1. I have a sentence that contains a number of long dataset names. I would like to allow LaTeX to break these names at certain positions that I would like to specify somehow just like I can use \- to allow a word break with hyphenation. But: I would like LaTeX not to insert a dash (which could be mistaken as belonging to the dataset name). How can I do this?   (Something similar is realized in the url package so I guess I could just read that code :) I would not like to use the url package here to be able to make a syntactical (and typographic) difference between urls and datset names.) How do I install Ubuntu from an USB drive / create a live USB-stick in Windows? How to select all faces with the same material? How to set QGIS language other then OS Where the property "__proto_" is stored? Delaunay triangulation to generate abstract networks and nodes The  states that:      The scores are created by comparing the word in the list in step 2* with all the 3-letter words. By using the scoring matrix (substitution matrix) to score the comparison of each residue pair, there are 203 possible match scores for a 3-letter word. For example, the score obtained by comparing PQG with PEG and PQA is 15 and 12, respectively with the BLOSUM62 weighting scheme.   I do not understand how they got a score of 15 for PQG v. PEG. What is a scoring matrix, how is it computed, and how is it used?      Step 2 on that page is Make a k-letter word list of the query sequence: “Take k=3 for example, we list the words of length 3 in the query protein sequence (k is usually 11 for a DNA sequence) sequentially, until the last letter of the query sequence is included”. Conditionally use 32/64 bit reference when building in Visual Studio What measures can/should I take to make sure that security around my SSH server is absolutely impermeable?  This will be community wiki from the start, so lets see what people do to secure their servers. Cauchy condensation test The following is Cauchy condensation test:  If $b_n \ge 0$ and $b_n \ge b_{n+1}$ then $\sum b_n$ converges if and only if $\sum 2^n b_{2^n}$ converges.  Is the following modified Cauchy condensation test possible:  Let $N \in \mathbb N$. Then if $b_n \ge 0$ and $b_n \ge b_{n+1}$ then $\sum b_n$ converges if and only if $\sum N^n b_{N^n}$ converges? I just saw now that a new build had rolled out in which the comment upvote and flag options are always visible. Previously, one had to mouse over the area in order to see them.  Why was this just changed? Is it to support touch screens? I'll admit, it was difficult to find the flag button using my touchscreen laptop running Microsoft Edge.  Cross-site duplicate on MSO: This question is a bit more subjective, but I'm hoping to get some new perspective.  I'm so used to designing for certain screen size (typically 1024x768) that I find that size to not be a problem.  Expanding the size to 1280x1024 doesn't buy you enough screen real estate to make an appreciable difference, but will give me a little more breathing room.  Basically, I just expand my "grid size" and the same basic design for the slightly smaller screen still works.  However, in the last couple of projects, my clients were all using 1080p (1920x1080) screens and they wanted solutions to use as much of that real estate as possible.  1920 pixels across provides just under twice the width I am used to, and the widescreen makes some of my old go to design approaches not to work as well.  The problem I'm running into is that when presented with so much space, I'm confronted with some major problems.   How many columns should I use?  The wide-format lends itself to a 3 column split with a 2:1:1 split (i.e. the content column bigger than the other two).  However, if I go with three columns what do I do with that extra column? How do I make efficient use of the screen real estate?  There's a temptation to put everything on the screen at once, but too much information actually makes the application harder to use.  White space is important to help make sense of complex information, but too much makes related concepts look too separate. I'm usually working with web applications that have complex data, and visualization and presentation is key to making sense of the raw data.  When your user also has a large screen (at least 24"), some information is out of eyesight and you need to move the pointer a long distance. How do you make sure everything that's needed stays within the visual hot points? Simple sites like blogs actually do better when the width is constrained, which results in a lot of wasted real estate.  I kind of wonder if having the text box and the text preview side by side would be a big benefit for the admin side of that type of screen? (1:1 two-column split).   For your answers, I know almost everything in the design is "it depends".  What I'm looking for is:   General principles you use How your approach to design has changed   I'm finding that I have to retrain myself how to work with this different format.  Every bump in the resolution I've worked through to date has been about 25%: 640 to 800 (25% increase), 800 to 1024 (28% increase), and 1024 to 1280 (25% increase).  However, the jump from 1280 to 1920 is a good 50% increase in space--the equivalent from jumping from 640 straight to 1024.  There was no commonly used middle size to help learn lessons more gradually.    To help focus the question a little bit, I had a project that was somewhat similar to Atlassian JIRA, an issue management system.  There were about six different types of records the client wanted to keep, all of them could potentially be related to each other.  Gathering data wasn't the core problem, although it did play a part.  The more important side of the problem was creating a system which would suggest potential relationships between the records and helped the analysts recognize patterns in the reported incidents.  There were different types of analysts that focused on the different problem domains, and due to the nature of their exploratory type of work, they didn't know what they wanted.  They just knew they had to make sense of a lot of data, draw correlations, and characterize classes of issues.    (Originally asked here: , but told that this might be more appropriate)    For the bounty: Stretch your minds a bit.  The pat answer "Make everything bigger" has a limit to how useful the answer is.  We are talking about users who have to make sense of a lot of data and find relationships between records.  If I simply bump up the size on everything they are going to be very limited in what they can see on the screen--particularly because the vertical is so constrained. How to output HTML from JSP  block? I just started learning JSP technology, and came across a wall.  How do you output HTML from a method in &lt;%! ... %> JSP declaration block?  This doesn't work:  &lt;%!  void someOutput() {     out.println("Some Output"); } %&gt; ... &lt;% someOutput(); %&gt;   Server says there's no &ldquo;out&rdquo;.  U: I do know how to rewrite code with this method returning a string, but is there a way to do this inside &lt;%! void () {  } %> ? Though it may be non-optimal, it's still interesting. I meet with term 'empty function' from time to time. It's high time to understand its nature. What is field( set of arguments) and what is image? ( set of value)? How do I verify that a string only contains letters, numbers, underscores and dashes? I know how to do this if I iterate through all of the characters in the string but I am looking for a more elegant method. "This site is all about getting answers. It's not a discussion forum. There's no chit-chat." What are some typical LuaTeX gotchas? What does the term "BODMAS" mean? What is BODMAS and why is it useful in programming? Addon scripts overriding each other