danilotaveira at uol
Feb 12, 2005, 5:59 PM
Views: 511
Permalink
|
Hi, one of my servers has been compromised. The person who did it changed
the ssh binary to log every ssh attempt to /usr/local/doc/.sh.
On this file each attempt is recorded in this way:
Host: hostname
User: user
Password: password
Is it some known exploit or it is a special ssh version compiled by the
attacker?
|
SSH hacked
