해킹 저두 달할줄이야...

.

os: liun7.3

# last

결과 삭제되구 3줄있더라구요.

보안에 무관했던 죄인지  어누분이 저의 서버를 해킹해서 사용하는거 같은데..

어떤걸 건들였는지 확인할 방법을 모르겠어요.

어떤로그 파일을 봐야 해킹한분을 찾을수있는지.

뭘하고 간건지 알수가 없네요...

지금은 /etc/hosts.allow 에 아이피를 막어넣는걸로 방어를 했고

chkrootkit  채크를 해보니

#./chkrootkit

Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found

Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.6.1/i386-linux/.packlist /usr/lib/perl5/5.6.1/i386-linux/auto/Time/HiRes/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gnome/Applet/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gnome/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/GLArea/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/Gdk/ImlibImage/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/Gdk/Pixbuf/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/GladeXML/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/XmHTML/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Gtk/base/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Mail/SpamAssassin/.packlist /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/mod_perl/.packlist

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found

가운데 무언가 설치 되었다고 나오는데 ..

아구 급한 마음에 조언 부탁드려요..ㅡㅜ