We're running an in house dedicated server with 100's of sites on it. Some of these sites were very insecure and the box was not managed very well. Some one got in, messed up a bunch of stuff and is pestering us by defacing some of the sites, asking for money etc.
We made a lot of fixes but there is still some sort of backdoor through which he can get in. We found and deleted a few files that were a kind of hacker control panel but since the file was just called contactUs.php, it's impossible to know that all instances of these kinds of files were removed.
I realise this is a very broad subject and a question that may be difficult to answer but what steps would one undertake to find out how this person is getting in to the system?
It's a Fedora machine running mainly PHP sites.