I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite opening the EC2 instance only last month. Today's access_log is growing. The log file is full of sites that have nothing to do with the site I am working on.
A handful of people had ssh access, but I've revoked it. Still, the log files grow.
Ended up getting some emails from amazon about "abuse" and found that there was a jump in mail activity. Strangely, I never set up mail service on this instance but the firewall has been set to allow smtp access (amongst other things), this is even though I only set port 80 access and a few port 22's.
I'm not really much of a server guy and I don't know any.
I've changed my Amazon passwords and created new access codes. Changed the ports for ssh to different ones.
I'd really appreciate any advice on this subject. Thanks.
//******** *EDIT *********/
I now believe that this was the result of having my server used as a proxy. As per these guidelines http://wiki.apache.org/httpd/ProxyAbuse I've managed to stem a great majority of the false traffic going to the site, though the requests are still piling up on the access_logs. I've confirmed by trying to use my server as a proxy and it forces users to the site directly -- the way I guess it should -- instead of say, yahoo.com.
I don't know if this was the solution but so far it seems to be working out -- so far.
Still, the answers posted have opened my eyes. If anyone has more to tell I would gladly hear it.
Thanks very much!