(See update below) I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump:
- Destination IPs:
- Destination Ports:
- Destination URLs:
- Abuse Time: Sun May 16 10:13:00 UTC 2010
- NTP: N
- Log Extract:
External 184.xxx.yyy.zzz, 11.842.000 packets/300s (39.473 packets/s), 5 flows/300s (0 flows/s), 0,320 GByte/300s (8 MBit/s)
(184.xxx.yyy.zzz is my instance ip)
How can I tell whether someone has penetrated my instance? What are the steps I should take to make sure my instance is clean and safe to use? Is there some intrusion detection techinque or log that I can use?
Any information is highly appreciated.
UPDATE: I received further log files from Amazon. seems like our server is scanning consecutive IP addresses for port 22. I ran rkhunter and chkrootkit without success. What can I do?