Somebody probably noticed that the server went down early Friday morning. Some fuck face exploited a vulnerability in order to upload a script that connected back to him, giving him a live shell. He/she used this shell to launch a UDP flood attack on a server in Romania. My provider pulled the plug after they clocked 41GB of traffic coming from the server and destined for a single IP. After I talked to my provider, I backed up the system and erased the disk so the server could be re-imaged.

I managed to restore email service by Saturday afternoon, but I would not bring the websites back up until I figured out exactly how the scumbags had uploaded their script (I'm not interested in a sequel of this event). After scouring the logs I finally fit the last piece of the puzzle in place Sunday night. I instituted some new security measures before bringing the websites and blogs back online Monday afternoon.
Everything should be back to normal now, but let me know if something is broken or out of place.

This entry was posted by ra on Monday, 03 October 2005 at 23:38. You can leave a response, or trackback from your own blog.