148 reputation
5
bio website mojoplease.com
location London, United Kingdom
age 33
visits member for 2 years, 6 months
seen Jul 2 at 12:58

Sep
6
comment Amazon S3 sync theory
@MichaelKjörling Thanks Michael - great suggestion. I'll ask another question and hopefully find out what is going on
Sep
6
comment Amazon S3 sync theory
Thanks @MichaelKjörling. So, I'm mounting the drive and then copying a file into that mounted directory to be sent to S3. When I un-mount the drive, the files I copied into that directory when it was mounted are still there. So when I re-mount, I get that warning. Should those files copied in there when it was mounted still be there when I unmount? Sorry for the lack of general knowledge here.
Sep
6
comment Amazon S3 sync theory
@MichaelKjörling When I first set it up, it's empty, but as I add files to it, it has contents every subsequent mount. I just had a thought - when I unmount, that directory shouldn't exist any more?
Sep
6
comment Amazon S3 sync theory
Downvoter - why and suggested improvements please. Just a downvote doesn't help anyone
Sep
6
awarded  Editor
Sep
6
revised Amazon S3 sync theory
added 67 characters in body
Sep
6
asked Amazon S3 sync theory
Jul
24
awarded  Teacher
Nov
8
asked Handling multiple requests faster
Jun
14
answered Huge load on Centos, many apache processes
Jun
14
comment Apache process con.shs using 100% load on CentOS. What is it?
Great response, thanks Jay. Will go away and do some more research and patch all the software I have. FYI, it was a trojan that I tracked down with your answers/comments; thanks.
Jun
14
accepted Apache process con.shs using 100% load on CentOS. What is it?
Jun
14
comment Apache process con.shs using 100% load on CentOS. What is it?
Thanks Jay, looks like /usr/sbin/httpd forked the process, which isn't overly useful. Next step I guess is to find out which files were edited when the compromise occurred and see if I can track down the offending file (if there is one), before I blast everything away and rebuild? Have you got any reading suggestions for tracing issues like this?
Jun
14
awarded  Supporter
Jun
14
awarded  Scholar
Jun
14
accepted Huge load on Centos, many apache processes
Jun
14
comment Apache process con.shs using 100% load on CentOS. What is it?
Wow, fantastic info. I've done this and tracked down everything you've said. exe file is in /dev/shm, and cmdline contains /bin/bashs190.480, so it definitely looks suspicious. My problem now is what to do with that information. Do I delete those files? Is it possible to find out how it was installed?
Jun
14
asked Apache process con.shs using 100% load on CentOS. What is it?
Jun
14
comment Huge load on Centos, many apache processes
Thanks Ladadadada, it looks like they're looping through IPs because they're slowly incrementing but I managed to preempt an IP range and got a lot of this: 10:15:22.012238 IP xx.xx.xx.xx.56270 > 169.90.225.125.http: S 2429420269:2429420269(0) win 5840 <mss 1460,sackOK,timestamp 3753976813 0,nop,wscale 7> E..<!.@.@.. _.E@.Z.}...P....................... ..#.........
Jun
14
comment Huge load on Centos, many apache processes
Thanks Ladadadada, I've tried running that command on a selection of the IP addresses, but they seem to be opening and closing connections so quickly I can't find one that's returning anything. I suspect we have been hacked though, so going through the link provided.