I believe my server has just got compromised interactively.
As this server will go to thrash anyway, I wonder if I can get a better insight of what the villain is doing by forcing logging of all tty.
Years ago I've seen a kernel patch, that does just that, but I can't find it anymore. I wonder, if such patch exist (I don't know how to write one).
The best would be, if the output wouldn't be stored locally, but forwarded to my other host (e.g. by http post or even as netcat).
My host uses 3.8 mainline kernel.