มีการใช้เครื่องยิง ssh เครือ่งคนอื่น

[root@server www]# netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:621                 0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:10000               0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:25                  0.0.0.0:*                   LISTEN      
tcp       53      0 202.142.223.170:50573       217.175.42.169:22           CLOSE_WAIT  
tcp       53      0 202.142.223.170:43897       217.175.253.28:22           CLOSE_WAIT  
tcp       69      0 202.142.223.170:54317       217.179.106.241:22          CLOSE_WAIT  
tcp      472      0 202.142.223.170:40975       217.177.154.115:22          ESTABLISHED
tcp       85      0 202.142.223.170:44224       217.177.156.123:22          CLOSE_WAIT  
tcp       53      0 202.142.223.170:45267       217.175.253.22:22           CLOSE_WAIT  
tcp       69      0 202.142.223.170:55768       217.179.106.247:22          CLOSE_WAIT  
tcp       69      0 202.142.223.170:44278       217.174.251.10:22           CLOSE_WAIT  
tcp       53      0 202.142.223.170:59959       217.175.246.121:22          CLOSE_WAIT  
tcp       42      0 202.142.223.170:53820       217.175.246.77:22           ESTABLISHED
tcp      720      0 202.142.223.170:47914       217.175.237.36:22           ESTABLISHED
tcp      464      0 202.142.223.170:55731       217.177.156.91:22           ESTABLISHED
tcp      465      0 202.142.223.170:57929       217.175.253.26:22           CLOSE_WAIT  
tcp      641      0 202.142.223.170:54553       217.177.13.200:22           CLOSE_WAIT  
tcp       52      0 202.142.223.170:57619       217.175.231.8:22            ESTABLISHED
tcp       52      0 202.142.223.170:48033       217.175.231.78:22           ESTABLISHED
tcp      464      0 202.142.223.170:43516       217.180.28.191:22           ESTABLISHED
tcp       69      0 202.142.223.170:58029       217.180.16.247:22           CLOSE_WAIT  
tcp      705      0 202.142.223.170:49628       217.177.154.103:22          CLOSE_WAIT  
tcp      464      0 202.142.223.170:40202       217.180.28.189:22           ESTABLISHED
tcp      608      0 202.142.223.170:46280       217.175.246.109:22          ESTABLISHED
tcp      465      0 202.142.223.170:55917       217.175.253.20:22           CLOSE_WAIT  
tcp       21      0 202.142.223.170:55692       217.175.253.18:22           CLOSE_WAIT  
tcp      705      0 202.142.223.170:48092       217.175.161.34:22           CLOSE_WAIT  
tcp       85      0 202.142.223.170:50084       217.177.156.125:22          CLOSE_WAIT  
tcp       69      0 202.142.223.170:44234       217.179.69.200:22           CLOSE_WAIT  
tcp       53      0 202.142.223.170:43313       217.175.121.20:22           CLOSE_WAIT  

มีการแอบวาง script ไว้ที่ /home

[root@server info]# ls
Maildir
[root@server info]# cd ..
[root@server home]# cd hr-bk/
[root@server hr-bk]# ls
lc-bk  lc.tgz  Maildir  ssh.tgz
[root@server hr-bk]# rm -Rf lc-bk/ lc.tgz ssh.tgz

ดูแล้ว user hr โดน hack แน่นอน ต้องทำหยุด

ทำการหยุด user hr
[root@server www]# skill -STOP -u hr